guide-bridge-trez[.]pages[.]dev

This domain, guide-bridge-trez.pages.dev, poses a brand impersonation threat targeting users of Trezor hardware wallets. The site mimics the official Trezor Bridge software page, presenting itself as "Trezor Bridge® | Official Secure Your Access" to deceive victims into entering sensitive credentials, such as wallet recovery phrases or private keys. The fraudulent page leverages a legitimate-looking interface to exploit trust in the Trezor brand, increasing the likelihood of successful credential theft or malware distribution under the guise of a software update or authentication process. Analysis of the domain reveals multiple indicators of malicious activity. The domain was registered through Cloudflare, Inc., and resolves to the IP address 188.114.97.3. It appears on one security blocklist and is flagged by 3 out of 95 security vendors on VirusTotal, including detection as a phishing site. The domain was created on April 04, 2024, and uses an SSL certificate issued by Google Trust Services, which may lend an appearance of legitimacy. Additionally, the domain has been assigned a trust score of 0/100 by Gridinsoft, further confirming its malicious nature. Users who visited guide-bridge-trez.pages.dev should take immediate action to mitigate potential risks. Disconnect any devices that interacted with the site and cease all further communication with the domain. Scan affected systems for malware using updated security tools, focusing on detecting credential stealers or remote access trojans. If sensitive information, such as wallet recovery phrases or private keys, was entered, assume compromise and transfer assets to a new, secure wallet. Monitor accounts for unauthorized transactions and report the incident to relevant security teams or fraud reporting platforms. Reset credentials for any accounts accessed during or after the interaction with this domain.