tr-jr-bridge[.]pages[.]dev

This domain, tr-jr-bridge.pages.dev, was flagged on July 25 2026 as an elevated‑risk brand‑impersonation campaign targeting Trezor users. The site’s title, “Seamless Crypto Management with Trezor Bridge,” and the explicit brand reference confirm the impersonation intent. The domain was registered on 24 March 2026 through Cloudflare, Inc., and is served from the IP address 172.66.44.60, which belongs to Cloudflare’s network in Canada. DNS resolution uses Cloudflare’s authoritative nameservers conrad.ns.cloudflare.com and daphne.ns.cloudflare.com, and the web service presents a Google Trust Services / WE1 SSL certificate, HSTS enforcement, and HTTP/3 support.

An HTTP 403 response is returned for the current request, and the domain is presently taken offline. Reputation data shows a Gridinsoft trust score of 0 out of 100, indicating a malicious classification. VirusTotal analysis recorded nine positives out of ninety‑four scanning engines, and the domain appears on a single security blocklist. PhishDestroy has also blocked the host.

The observed infrastructure—fully hosted on Cloudflare—obscures the underlying operator, but the short life span, zero trust score, and brand‑specific page title are consistent with a phishing or investment‑scam pattern. Defenders should add tr-jr-bridge.pages.dev to URL filtering policies, monitor for re‑registration or similar sub‑domains, and enforce TLS inspection to capture any future payloads. Continuous threat‑intel feeds should be consulted for updates, and any internal logs containing requests to this host should be reviewed for potential compromise.