en-briddge[.]framer[.]ai

Analysis of the domain en-briddge.framer.ai indicates it was actively used in a phishing campaign targeting users of the Trézor hardware wallet. The page title, 'Official Trézor Bridge® Download,' explicitly suggests an attempt to deceive victims into downloading malicious software under the guise of a legitimate Trézor product. The domain was registered on March 3, 2026, through CSC Corporate Domains, Inc., and resolved to the IP address 31.43.160.6, hosted on Amazon.com, Inc. infrastructure (AS16509) in the Netherlands. As of July 24, 2026, the domain returns an HTTP 404 status, confirming it has been taken offline. Infrastructure analysis reveals the use of Framer Sites and React, alongside security headers such as HSTS and HTTP/3.

The SSL certificate was issued by Let’s Encrypt (serial number E8), a common choice for both legitimate and malicious sites. The domain’s nameservers are hosted on AWS (awsdns-45.co.uk, awsdns-15.net, awsdns-21.org, and awsdns-59.com), a pattern observed in other phishing operations leveraging cloud infrastructure for rapid deployment and scalability. Detection data from July 2026 shows the domain was flagged by five of 95 security vendors on VirusTotal, though the specific detection rules or signatures are not publicly disclosed. It was also listed on at least one security blocklist, specifically PhishDestroy, which contributed to its classification as an elevated-risk threat. The combination of a targeted brand impersonation, cloud-based hosting, and detection by multiple security vendors underscores the domain’s malicious intent.

Defenders are advised to treat any historical traffic or downloads associated with this domain as compromised. Organizations should review logs for connections to 31.43.160.6 or requests to en-briddge.framer.ai, particularly from users who may have interacted with Trézor-related content. While the domain is currently offline, the infrastructure (e.g.