terser-bridges-s[.]pages[.]dev

The domain terser-bridges-s.pages.dev was identified as a brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet company. This phishing domain posed as the official Trezor Bridge page, luring users with a fraudulent interface designed to steal sensitive information such as wallet recovery phrases or login credentials. No specific drainer kit was mentioned in the intelligence, but the page title 'Official Trézor™ Bridge® | Introducing the New Trezor®' indicates a sophisticated impersonation attempt.

Technical indicators reveal that the domain was registered through Cloudflare, Inc. on March 25, 2026, and resolved to IP address 188.114.97.3. It used an SSL certificate issued by Google Trust Services (WE1). VirusTotal flagged the domain with a score of 7/95, meaning 7 security vendors out of 95 detected it as malicious. The domain also appeared on one security blocklist. Despite these red flags, the domain was not listed on Google Safe Browsing (GSB) at the time of analysis, which may have contributed to its brief availability.

The domain was taken offline after detection, but the risk remains elevated due to the potential for similar domains to reappear under different subdomains or registrars. Users are strongly advised to verify the authenticity of any Trezor-related websites by always accessing them through the official Trezor website or app, and to never enter sensitive information on pages accessed via unsolicited links. PhishDestroy recommends using browser security extensions and keeping wallets updated to mitigate such threats.