store-terzor-bridge[.]pages[.]dev

The domain store-terzor-bridge.pages.dev was registered on 2026-04-03 through Cloudflare, Inc. and currently resolves to the Cloudflare‑owned IP 188.114.96.3 located in CA. The site returns HTTP 200 and presents a valid SSL certificate issued by Google Trust Services (WE1). Page title observed is “Trezor Bridge | Getting Started Guide”, indicating an attempt to impersonate the Trezor hardware‑wallet brand. Gridinsoft assigns a trust score of 0/100, and VirusTotal records 15 detections out of 94 scanners, confirming malicious classification. The infrastructure is hosted behind Cloudflare’s maeve.ns.cloudflare.com and sullivan.ns.cloudflare.com name servers. The domain is listed on one security blocklist and has been blocked by PhishDestroy. Risk rating is high and status is active. Analysis indicates the primary threat is brand impersonation aimed at luring Trezor users into downloading malicious software or providing credentials. No additional payload or page content has been publicly disclosed, so the exact malicious behavior remains uncertain. Defenders should add the domain and its IP to network deny lists, enforce DNS filtering, and educate users that the legitimate Trezor Bridge service does not use a pages.dev subdomain. Continuous monitoring of Cloudflare‑associated IP ranges for similar patterns is recommended.