treezor-bridge-us[.]pages[.]dev

The domain treezor-bridge-us.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. It presents itself as 'Trezor Bridge: Secure Connection for Your Hardware Wallet' to deceive users into believing it is an official service, posing an elevated risk of cryptocurrency scams. No drainer kit was identified, but the site was actively used for cryptocurrency-related fraud before being taken offline.

Technical indicators confirm the malicious nature of treezor-bridge-us.pages.dev. As of analysis, 1 of 95 VirusTotal security vendors flagged the domain, while it appeared on 1 security blocklist (PhishDestroy). The domain was registered through Cloudflare, Inc. on September 24, 2025, and resolved to the IP address 188.114.97.3, hosted by Cloudflare in Canada. The SSL certificate was issued by Google Trust Services (WE1), and the site employed technologies such as Tailwind CSS, HSTS, and HTTP/3. The observed page title matched the impersonated Trezor service, and the domain was blocked by PhishDestroy with a Gridinsoft trust score of 0/100.

Users who interacted with treezor-bridge-us.pages.dev should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication (2FA). Report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand’s security team to aid in takedown efforts and prevent further victimization.