pages-brdge-io-eng[.]pages[.]dev

Analysis of the domain pages-brdge-io-eng.pages.dev indicates active brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. The domain, registered on April 4, 2026, resolves to IP 188.114.97.3, hosted under Cloudflare, Inc. (AS13335) in Canada. The page title, 'Trezor Bridge - Secure Your Crypto Assets,' explicitly mimics Trezor's official software, suggesting an intent to deceive users into believing the site is legitimate. The domain is flagged by 10 of 94 security vendors on VirusTotal and appears on one security blocklist, reinforcing its malicious classification. Infrastructure analysis reveals Cloudflare nameservers (holly.ns.cloudflare.com, piotr.ns.cloudflare.com) and a Google Trust Services SSL certificate (WE1), common in both legitimate and malicious deployments. The domain remains active as of July 12, 2026, with an HTTP 200 status, indicating no takedown or server-side blocking. Defenders should treat this domain as high-risk for credential harvesting or malware distribution, particularly targeting cryptocurrency users. No evidence of a specific phishing kit or payload is currently available, but the combination of brand impersonation, recent registration, and security vendor detections warrants immediate blocking and further investigation. Network-level mitigations, such as DNS sinkholing or firewall rules, are recommended to prevent access.