adv-trzrbridge-en[.]pages[.]dev

This domain represents a high-risk brand impersonation threat specifically targeting users of Trezor hardware wallets. Analysis indicates the infrastructure was designed to mimic the legitimate Trezor Bridge software, which serves as a communication layer between hardware wallets and web browsers. The page title 'Trezor Bridge — The Secure Gateway to Your Hardware Wallet®' precisely replicates official branding, suggesting an attempt to harvest wallet credentials, recovery seeds, or install malicious software under the guise of a legitimate update or connection tool. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on June 15, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.156. Security vendors flagged this domain in 13 out of 95 VirusTotal scans, while it appears on three distinct security blocklists. The SSL certificate is issued by Google Trust Services, and the domain employs HSTS and HTTP/3 protocols, likely to enhance perceived legitimacy. Despite these technical measures, the domain holds a Gridinsoft trust score of 0/100, and multiple security entities, including MetaMask and PhishDestroy, have blocked access. Users who visited adv-trzrbridge-en.pages.dev should immediately cease all interaction with the domain and any associated software. If credentials, recovery seeds, or wallet information were entered, affected users must transfer assets to a new, secure wallet and revoke any connected sessions or authorizations. A full system scan using updated security tools is recommended to detect potential malware. Additionally, users should monitor their wallet addresses for unauthorized transactions and report the incident to relevant security response teams for further analysis and mitigation.