r-trez-rbridg-app[.]pages[.]dev

PhishDestroy identifies r-trez-rbridg-app.pages.dev as a confirmed phishing site designed to steal cryptocurrency wallet credentials, specifically impersonating Trezor hardware wallet services. The domain is currently offline, having been taken down after security vendors flagged its malicious activity. This threat type is generic phishing, but the domain name strongly suggests a targeted campaign against Trezor users, aiming to harvest sensitive recovery phrases or login details.

The domain was created on April 2, 2026, and registered through Cloudflare, Inc., resolving to IP address 188.114.97.3. Its SSL certificate was issued by Google Trust Services (WE1). On VirusTotal, 10 out of 95 security vendors flagged this domain as malicious, and it appears on one security blocklist. The page title displayed a Cloudflare phishing warning, indicating that the site was blocked by Cloudflare's security systems. These technical indicators, combined with the recent creation date and low registration transparency, confirm the domain's malicious intent.

As the site is offline, the immediate risk is neutralized, but users should remain vigilant for similar phishing attempts. PhishDestroy recommends that Trezor users always verify URLs directly from official sources, never enter recovery phrases on third-party sites, and enable two-factor authentication. If any credentials were entered on this domain, users should immediately transfer funds to a new wallet and contact Trezor support. Regular monitoring of blocklists and using browser security extensions can help prevent future encounters with such threats.