project-bridge-trzr[.]pages[.]dev

Analysis of project-bridge-trzr.pages.dev indicates this domain was actively impersonating Trezor, a cryptocurrency hardware wallet provider, as part of a crypto scam operation. The domain was registered on March 22, 2026, through Cloudflare, Inc., and resolved to IP address 172.66.44.167, hosted by Cloudflare in California. The page title, 'Trezor Bridge — Secure Connection for Your Trezor,' directly mimics official Trezor software, suggesting an intent to deceive users into believing the site was legitimate Trezor infrastructure. At the time of assessment, the domain returned an HTTP 403 status, indicating access was forbidden, and it has since been taken offline.

Security vendor detection on VirusTotal showed 9 of 94 engines flagging the domain as malicious, supporting its classification as a threat. The domain appeared on one security blocklist and was specifically blocked by PhishDestroy. Gridinsoft assigned a trust score of 0/100, further confirming its high-risk status. The SSL certificate, issued by Google Trust Services (WE1), is consistent with Cloudflare-hosted domains and does not indicate legitimacy.

Nameservers archer.ns.cloudflare.com and stevie.ns.cloudflare.com align with Cloudflare’s infrastructure, commonly used for both legitimate and malicious sites. While the exact content and functionality of the site remain unanalyzed due to its offline status, the available evidence—including the page title, brand impersonation, detection by security vendors, and presence on a blocklist—strongly supports its classification as a crypto scam. Defenders should treat this domain as malicious and include it in blocklists, monitoring for any reactivation or related infrastructure. No evidence suggests this domain was part of a broader phishing kit or campaign beyond the Trezor impersonation.