helps-bridg--e[.]pages[.]dev

This domain, helps-bridg--e.pages.dev, is flagged as a brand impersonation phishing site targeting Trezor, a cryptocurrency hardware wallet provider. The page title, 'Trezor Bridge | Getting Started Guide,' mimics official Trezor documentation to deceive users into downloading malicious software or divulging sensitive credentials. No evidence of a drainer kit was observed, but the site employs social engineering tactics typical of cryptocurrency-related phishing campaigns.

Analysis indicates the domain was registered on March 25, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.47.97. It is detected by 12 out of 95 security vendors on VirusTotal, with one appearance on a security blocklist. The domain uses a Google Trust Services SSL certificate and employs infrastructure technologies such as HSTS, Cloudflare, and HTTP/3. Despite its elevated risk classification, the domain is not currently listed on Google Safe Browsing (GSB).

As of the latest assessment, helps-bridg--e.pages.dev has been taken offline, likely due to enforcement actions by security providers or the hosting platform. However, the risk of reemergence or migration to a new domain remains. Users and organizations are advised to monitor for similar impersonation attempts, verify domain authenticity before interacting with Trezor-related content, and implement network-level blocking of the identified IP address and associated indicators of compromise.