info-trzr-brdge[.]pages[.]dev

info-trzr-brdge.pages.dev is an active brand impersonation domain currently under investigation for posing as Trezor’s official Bridge service.

This domain, registered via Cloudflare, Inc., resolves to IP 188.114.96.3 and has been flagged by 8 of 95 VirusTotal vendors as of the latest scan. It utilizes a Google Trust Services SSL certificate and presents a fraudulent page titled “Trezor Bridge — Secure & Smooth Crypto Access.” The domain remains accessible and continues to operate despite its suspicious intent.

The domain is categorized as a high-risk brand impersonation threat due to its direct targeting of the Trezor cryptocurrency wallet brand. Technical indicators include a clean detection score on VirusTotal, a legitimate-looking SSL certificate, and hosting on a reputable cloud provider, which increases its deceptive credibility. However, the mismatch between the service name (Trezor Bridge) and the domain’s registered purpose clearly signals malicious intent. Users are advised to avoid interacting with this domain, verify official Trezor domains through their verified channels, and report any observed activity to relevant security teams. Security teams should monitor for similar domains and consider blocking IP 188.114.96.3 and the Cloudflare-associated ASN to prevent further exposure.