help-bridge-doc-xx[.]pages[.]dev

The domain help-bridge-doc-xx.pages.dev has been identified as a brand impersonation threat specifically targeting Trezor, a well-known cryptocurrency hardware wallet provider. Analysis confirms the domain was designed to deceive users into believing it is an official Trezor service, likely for the purpose of credential theft or unauthorized access to crypto assets. The domain is currently offline, but its prior activity warrants caution. Infrastructure analysis reveals several critical indicators. The domain resolves to the IP address 172.66.44.210 and was registered through Cloudflare, Inc. on March 29, 2026. The SSL certificate is issued by Google Trust Services under the identifier WE1, a common characteristic of legitimate-looking but fraudulent domains. Security vendors have flagged this domain, with 3 out of 95 VirusTotal engines detecting malicious activity. Additionally, the domain appears on one security blocklist, further corroborating its suspicious nature. The page title, 'Trezor Bridge | Starting® Up® Your® Device®®,' closely mimics official Trezor branding, including the use of registered trademark symbols to enhance authenticity. While the domain is currently offline, the risk assessment remains elevated due to the targeted nature of the impersonation and the potential for reemergence. Users who may have interacted with this domain are advised to immediately revoke any connected wallet permissions, reset credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address. Continuous monitoring of similar domains, particularly those leveraging Cloudflare Pages infrastructure with crypto-related branding, is recommended to mitigate future threats.