io-bridge-doc-pege[.]pages[.]dev

Analysis of the domain io-bridge-doc-pege.pages.dev indicates a brand‑impersonation operation targeting Trezor users. The domain was registered on March 22 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑managed address 172.66.44.74, which is geolocated to Canada. The site presents the page title “Trezor Bridge — Comprehensive Guide,” directly referencing the legitimate Trezor Bridge service, and the SSL certificate is issued by Google Trust Services under the WE1 root, confirming a valid TLS chain but offering no protection against malicious content. Infrastructure signals include the use of Cloudflare’s DNS (nameservers darl.ns.cloudflare.com and elinore.ns.cloudflare.com), enforcement of HTTP Strict Transport Security, and support for HTTP/3, all of which are typical for legitimate services and may be leveraged to mask illicit activity.

The site returned an HTTP 403 response before being taken offline, and the current status is recorded as offline. Reputation data shows a Gridinsoft trust score of 0 / 100 and placement on a single security blocklist. VirusTotal scans flagged the domain by ten of ninety‑four AV engines, and PhishDestroy has also blocked it. The combination of brand‑specific page title, recent creation date, and hostile detection profile suggests a crypto‑related scam designed to lure Trezor users into disclosing credentials or installing malicious software.

No public content or login pages have been captured, leaving the exact payload unknown. Defenders should continue to block the domain at DNS and proxy layers, monitor outbound connections to the associated IP, and add the domain to internal phishing and brand‑impersonation watchlists. Ongoing observation of Cloudflare‑registered domains that reference Trezor or other cryptocurrency hardware wallets is advised, as the infrastructure can be rapidly redeployed.