trzr-io--bridge[.]pages[.]dev

This domain, trzr-io--bridge.pages.dev, is flagged for brand impersonation targeting Trezor, a hardware cryptocurrency wallet manufacturer. The site mimics the official Trezor interface, presenting a page titled 'Trezor Hardware Wallet | Starting® Up® Your® Device®' to deceive users into entering sensitive information such as recovery seeds or private keys. Such impersonation typically precedes cryptocurrency theft, where attackers drain wallets by gaining access to credentials under false pretenses. The domain’s infrastructure and content are designed to exploit trust in the Trezor brand, increasing the likelihood of successful compromise for unsuspecting visitors. Analysis indicates the domain was registered through Cloudflare, Inc., and resolves to the IP address 188.114.96.3. It is detected by 10 out of 95 security vendors on VirusTotal, a notably higher detection rate than benign domains, which often register zero or single-digit flags. The domain was created on March 25, 2026, though this date may reflect registry manipulation or placeholder data. It appears on one security blocklist and has a trust score of 0/100, further corroborating its malicious nature. Technologies detected include HSTS, Cloudflare, and HTTP/3, which are consistent with modern web infrastructure but do not mitigate the domain’s fraudulent intent. Users who visited trzr-io--bridge.pages.dev should assume potential exposure of sensitive credentials. Immediate actions include revoking any wallet access granted during the visit, generating new recovery seeds, and transferring cryptocurrency assets to a new, secure wallet. System scans for malware are recommended, as brand impersonation sites often distribute additional payloads. Monitor financial accounts and enable multi-factor authentication where possible. If recovery seeds or private keys were entered, consider the associated wallet compromised and cease its use entirely. Report the domain to relevant security teams for further mitigation.