iobridge-trzer[.]pages[.]dev

Infrastructure analysis of iobridge-trzer.pages.dev indicates a confirmed phishing operation targeting Trezor, a hardware wallet provider. The domain, registered on April 15, 2026, through Cloudflare, currently resolves to IP address 188.114.96.3 and is hosted on Cloudflare's infrastructure, utilizing technologies such as HSTS and HTTP/3. The page title, 'Trezor Bridge — The Secure Gateway to Your Hardware Wallet®,' explicitly impersonates Trezor's branding, aligning with the reported threat type of brand impersonation. As of July 12, 2026, the domain remains active and is flagged on at least one security blocklist, with additional detection by one security vendor on VirusTotal. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious domains. While the domain's registration age (approximately three months) does not inherently indicate malicious activity, the combination of brand impersonation, active status, and security vendor detections elevates the risk level. Defenders are advised to treat this domain as high-risk infrastructure and implement blocking measures at the network and endpoint levels. Further investigation into associated email addresses, nameservers, or historical WHOIS records may reveal additional linked infrastructure. The exact content and functionality of the site remain unanalyzed, but the available evidence supports classification as a brand-impersonation phishing domain.