bridge-nav[.]zapier[.]app

This domain is flagged for brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. The threat type involves spoofing the legitimate Trezor Bridge software, which facilitates communication between the Trezor device and a user's browser. Analysis indicates an elevated risk level due to the domain's deceptive design and active exploitation attempts prior to takedown. Infrastructure analysis reveals the following technical indicators: The domain bridge-nav.zapier.app was registered on March 27, 2026, through Name.com, Inc., and resolves to the IP address 64.239.123.193, hosted by Vercel, Inc. in the United States. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains. The domain appears on one security blocklist and is flagged by 9 out of 95 security vendors on VirusTotal. The page title, 'Trezor Bridge: Secure,' directly mimics the legitimate Trezor Bridge interface, increasing the likelihood of successful deception. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP address (64.239.123.193) at the network perimeter. Security teams should alert users to verify domain authenticity before interacting with any Trezor-related software, particularly those hosted on third-party platforms like zapier.app. Monitoring for similar impersonation attempts—such as domains mimicking Trezor or other cryptocurrency tools—is recommended, along with deploying endpoint detection rules to flag suspicious SSL certificates or unexpected network connections to newly registered domains. Users should be advised to access Trezor software exclusively through official channels and enable multi-factor authentication where available.