as-trezor-bridge[.]pages[.]dev

Analysis dated July 24, 2026 flags as-trezor-bridge.pages.dev as a high‑risk impersonation of the Trezor brand. The domain was created on February 21, 2026 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.66.44.254, which belongs to ASN 13335 in the United States. DNS is served by piotr.ns.cloudflare.com and aria.ns.cloudflare.com, and the site advertises HSTS and HTTP/3 support under a Google Trust Services / WE1 certificate. The page title returned by the server is “Suspected phishing site | Cloudflare”, and the HTTP response code is 403, indicating that the host is currently blocking access.

Reputation services reflect extreme distrust: Scamadviser assigns a 1/100 trust score, Gridinsoft a 0/100 score, and the domain appears on a single known security blocklist, PhishDestroy. VirusTotal analysis shows that 15 of 93 scanning engines flagged the domain as malicious, confirming a consensus of suspicious activity. The listed scam type is “Crypto Scam”, and the impersonated brand is explicitly identified as Trezor. Because the domain is presently offline, no payload, login page, or credential‑stealing infrastructure could be observed, leaving the exact delivery mechanism uncertain.

However, the convergence of low trust scores, multiple vendor detections, and inclusion on a phishing blocklist strongly suggests that the site was intended to lure cryptocurrency users into disclosing private keys or seed phrases. The use of the pages.dev sub‑domain service is a known pattern for short‑lived phishing campaigns, and the presence of HSTS indicates that any future HTTPS connections would be forced to use secure transport, though the underlying malicious content remains unknown. Defenders should add the domain and its resolved IP address to inbound and outbound block lists, enforce strict TLS inspection for traffic to Cloudflare edge nodes, and monitor for similarly named subdomains under the pages.dev namespace that reference the Trezor brand.