brijges-guide[.]pages[.]dev

The phishing domain brijges-guide.pages.dev targeted Trezor users by mimicking the brand's suite setup page. Detected on the same day it was created, April 2, 2026, it quickly drew attention from security vendors, with 3 out of 94 flagging it as malicious on VirusTotal. The domain was hosted on Cloudflare infrastructure in Canada and utilized an SSL certificate issued by Google Trust Services.

Despite its short-lived activity, the domain managed to appear on one public blocklist—PhishDestroy's. This rapid detection and listing highlight the efficiency of PhishDestroy's threat intelligence pipeline, which captures threats in the critical window before broader antivirus database updates. The platform risk score of 61/100 underscores its potential threat level during its active phase.

The site, now offline, attempted to deceive users into believing they were interacting with Trezor's legitimate setup process. By exploiting the trust associated with Trezor's brand, attackers aimed to harvest sensitive information from unsuspecting users. The prompt takedown of brijges-guide.pages.dev mitigated further risk, but its existence serves as a reminder of the persistent threat posed by phishing domains.