io-trezo-bridge-in[.]pages[.]dev

Analysis of the domain io-trezo-bridge-in.pages.dev indicates elevated risk as a brand-impersonation crypto scam targeting Trezor users. The domain was registered on March 23, 2026, through Cloudflare, Inc., and is hosted on Cloudflare infrastructure, resolving to the IP address 188.114.97.3 located in Canada. The page title, 'Trezor Bridge | Secure Crypto Connection — Presentation,' explicitly references Trezor, a well-known cryptocurrency hardware wallet brand, aligning with the scam type classified as a crypto scam in available intelligence. Infrastructure analysis reveals the use of modern security protocols, including HSTS and HTTP/3, alongside Cloudflare's nameservers (eleanor.ns.cloudflare.com and ivan.ns.cloudflare.com).

The domain currently returns an HTTP 403 status, suggesting access is restricted or the site has been taken offline. The SSL certificate is issued by Google Trust Services (WE1), which is consistent with legitimate Cloudflare-hosted domains but does not mitigate the risk of impersonation. Security vendor detections further support the classification of this domain as malicious. As of the latest scan, 13 out of 94 security vendors on VirusTotal flagged the domain, and it appears on at least one security blocklist, specifically PhishDestroy.

Gridinsoft assigns a trust score of 0/100, indicating a high level of suspicion. While the domain is currently offline, defenders should treat it as a confirmed threat actor asset impersonating Trezor to target cryptocurrency users. Defenders are advised to block the domain at the DNS or proxy level, monitor for any re-emergence under similar naming conventions, and alert users to the risks of interacting with unsolicited Trezor-related domains. The combination of brand impersonation, crypto scam classification, and security vendor detections provides concrete evidence of malicious intent, despite the domain's current inaccessibility.