iobridge-terzer[.]pages[.]dev

PhishDestroy has identified iobridge-terzer.pages.dev as a confirmed phishing domain engaged in brand impersonation targeting Trezor, a leading hardware wallet provider. This fraudulent site, which posed as the official Trezor Bridge portal under the title 'Trezor Bridge – The Secure Gateway to Your Hardware Wallet®', was designed to trick users into entering sensitive login credentials and potentially connecting their hardware wallets, leading to asset theft. The threat type is categorized as brand impersonation with a crypto drainer component, as the page likely attempted to capture seed phrases or transaction approvals.

Technical indicators reveal a high-risk profile. The domain was registered on April 04, 2026, via Cloudflare, Inc., and resolved to IP address 172.66.44.130 with an SSL certificate from Google Trust Services (WE1). VirusTotal flagged the domain with 5 out of 95 security vendors, and it appeared on one security blocklist. These indicators, combined with the use of Cloudflare for registration and hosting, suggest the threat actor employed common obfuscation techniques to evade detection. The domain was not listed on Google Safe Browsing at the time of analysis, which underscores the importance of proactive monitoring.

As of the latest assessment, iobridge-terzer.pages.dev has been taken offline, effectively neutralizing the immediate threat. However, the risk to users remains elevated due to the potential for similar domains to appear under different subdomains or TLDs. PhishDestroy recommends that Trezor users always verify the official website URL directly from the manufacturer's support page and avoid clicking on unsolicited links. Additionally, enabling two-factor authentication and using a dedicated hardware wallet with verified firmware can mitigate losses. Users who may have interacted with this site should immediately transfer funds to a new wallet and run a security scan on their devices.