connec-bridge[.]pages[.]dev

The domain connec-bridge.pages.dev was registered on April 18, 2026 through Cloudflare, Inc., and resolves to the Cloudflare IP address 172.66.44.84 located in Canada. The site presents the page title "Trezor Bridge — Secure Connection for Your Trezor," explicitly referencing the hardware‑wallet brand Trezor, and the intelligence classifies the activity as a brand‑impersonation scam. The SSL certificate is issued by Google Trust Services under the WE1 root, indicating a valid TLS chain, but the HTTP response returned a 403 status code, suggesting the content is not publicly accessible at the time of testing. Security vendors on VirusTotal flagged the domain in 2 of 94 scans, and the site appears on a single external blocklist.

Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment. The domain is currently taken offline, and PhishDestroy has recorded the site as blocked. Nameserver configuration uses adam.ns.cloudflare.com and sara.ns.cloudflare.com, both standard Cloudflare resolvers.

While the offline status reduces immediate exposure, the infrastructure—particularly the use of a reputable certificate authority combined with a brand‑specific title—demonstrates a deliberate attempt to lend credibility to a malicious page. Defenders should continue to enforce blocking of the domain at network perimeter devices, update DNS filtering rules to include the associated IP and nameservers, and monitor for re‑registration or similar patterns targeting Trezor users. Awareness campaigns should inform end‑users that any unsolicited request to a "Trezor Bridge" hosted on a pages.dev subdomain is unauthorised, and legitimate Trezor communications will never originate from this namespace.