connect-bridge-trzzar[.]pages[.]dev

Analysis indicates that the domain connect-bridge-trzzar.pages.dev is actively used in a high‑risk phishing campaign. The domain was registered on 7 November 2025 via the Cloudflare Pages service, which provides automated hosting and DNS management. DNS resolution points to the IPv4 address 172.66.47.163, an address associated with Cloudflare’s edge network. The domain appears on three independent security blocklists and is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering solutions, confirming that multiple vendors have observed malicious activity originating from it.

VirusTotal reports that 13 of 91 scanned security engines have flagged the domain, reinforcing the suspicion of malicious intent. The intelligence set classifies the activity as generic phishing, and the risk level is marked as high, with the campaign status listed as active. Publicly available details such as the page title, SSL certificate metadata, or HTTP response codes have not been disclosed, leaving the exact content of the hosted page unverified. Consequently, defenders cannot confirm the specific lure or credential‑harvesting technique employed, but the convergence of blocklist listings, vendor detections, and the Cloudflare Pages hosting model strongly suggests a credential‑stealing operation.

Recommended mitigation steps include adding the domain and its resolved IP address to network allow‑lists and endpoint blocklists, enforcing DNS filtering that references the known blocklists, and monitoring for any outbound connections to 172.66.47.163. Continuous re‑scanning on VirusTotal or similar multi‑engine platforms is advised to capture any changes in detection ratios. Organizations should also educate users about the risk of unsolicited login prompts that may reference the “connect‑bridge‑trzzar” pattern, even though the exact visual presentation is not yet documented.