# PhishDestroy threat dossier — trrezor-briiddge.pages.dev ================================================================ Fetched: 2026-04-25 04:50:20 UTC Canonical: https://phishdestroy.io/domain/trrezor-briiddge.pages.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Trezor ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 7/94 security vendors flagged this domain Flagging vendors: ADMINUSLabs, BitDefender, CyRadar, Fortinet, G-Data, Kaspersky, Sophos ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: Cloudflare, Inc. Nameservers: quinton.ns.cloudflare.com, sunny.ns.cloudflare.com Registered: 2026-03-25 Page title: Trezor Bridge — Overview ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-06-23 Status: INVALID chain Fingerprint: 12da7cd95a20084825b5c1a208707af625fd0f0efda8634ac032dc95d115ec10 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-03-25 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-03-25 18:19:54 UTC (by PhishDestroy tracker) Last verified: 2026-04-21 16:08:06 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d2592-339a-7321-adb4-355e54ff8d8f/ Wayback Machine: https://web.archive.org/web/*/trrezor-briiddge.pages.dev crt.sh CT logs: https://crt.sh/?q=%25.trrezor-briiddge.pages.dev Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=trrezor-briiddge.pages.dev AlienVault OTX: https://otx.alienvault.com/indicator/domain/trrezor-briiddge.pages.dev URLhaus: https://urlhaus.abuse.ch/host/trrezor-briiddge.pages.dev/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-03-25 18:26:14 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies trrezor-briiddge.pages.dev as an active crypto drainer phishing domain designed to trick Trezor wallet users into connecting their accounts. This malicious site masquerades as a legitimate Trezor bridge service, leveraging Cloudflare’s infrastructure to host a convincing replica aimed at harvesting private keys or transaction approvals. The domain resolves to IP 188.114.97.3 and uses a Google Trust Services SSL certificate to appear trustworthy, a common tactic to bypass browser warnings. Unsuspecting victims who interact with this page risk irreversible cryptocurrency theft, as the backend infrastructure is engineered to drain connected wallets upon approval of fraudulent transactions. This domain was flagged by PhishDestroy with zero detections on VirusTotal as of the latest scan, indicating it has evaded most commercial detection systems. Registered through Cloudflare, Inc., the site appears newly minted, with no available creation date publicly listed—another red flag consistent with short-lived phishing campaigns. The absence of detections (0/95) and reliance on trusted infrastructure highlights the sophistication of the threat, which prioritizes speed and deception over long-term hosting. Additionally, the domain employs Pages.dev, a legitimate Cloudflare Pages service, to host dynamic content, making it harder to distinguish from benign sites without behavioral analysis. Users who visited trrezor-briiddge.pages.dev or entered any credentials should immediately disconnect their cryptocurrency wallets from the site and revoke any active permissions using official wallet tools. Do not interact with wallet connection prompts from unknown domains. If funds were lost, file reports with local law enforcement, your country’s cybercrime unit, and the wallet provider. Use hardware wallets or verified software clients for future transactions. Enable transaction simulation tools if available to preview malicious transfers. Stay updated by following official security advisories from Trezor or your wallet provider. [Updates since narrative was generated:] - WHOIS creation date: 2026-03-25 - VirusTotal detections: now 7/94 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 12da7cd95a20084825b5c1a208707af625fd0f0efda8634ac032dc95d115ec10 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/trrezor-briiddge.pages.dev/ JSON API: https://api.destroy.tools/v1/check?domain=trrezor-briiddge.pages.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io