bridge-trzr-eng-x[.]pages[.]dev

This domain, bridge‑trzr‑eng‑x.pages.dev, is actively serving a site titled “Trezor Bridge – Secure Your Cryptocurrency Easily,” which explicitly claims to represent the Trezor hardware‑wallet service. The site was registered on 27 April 2026 through Cloudflare, Inc., and the TLS certificate is issued by Google Trust Services under the WE1 root. DNS resolution points to IP 188.114.97.3, a Cloudflare edge node located in Canada, and the authoritative nameservers are lorna.ns.cloudflare.com and mack.ns.cloudflare.com. The server enforces HTTP Strict Transport Security and supports HTTP/3, indicating a modern Cloudflare configuration. Reputation metrics are poor: Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports 10 of 91 scanning engines flag the domain as malicious. The domain appears on at least one public blocklist and has been taken down by the PhishDestroy mitigation service, yet it remains reachable with HTTP 200 responses. The observed indicators confirm a high‑risk brand‑impersonation campaign targeting Trezor users. Uncertainty remains regarding the exact payload delivered after initial page load, as no further content analysis is available. Defenders should immediately block the domain at perimeter and DNS layers, add the IP address and nameservers to threat‑intel feeds, and monitor for outbound connections to the Cloudflare edge node. Continuous inspection of TLS handshakes and HTTP/3 traffic for this host is recommended, as is updating URL‑filtering rules to capture the specific page title pattern. Ongoing telemetry should be collected to detect any evolution of the infrastructure.