bridge-terzors-cdn-io[.]pages[.]dev

This domain is flagged for brand impersonation, targeting the Trezor brand, and is assessed as having an elevated risk level. The threat involves a phishing campaign designed to mislead users into believing they are accessing a legitimate Trezor service, potentially compromising sensitive information.

Analysis indicates that the domain bridge-terzors-cdn-io.pages.dev was created on March 23, 2026, and is registered through Cloudflare, Inc. The domain resolves to the IP address 188.114.97.3, which is located in CA (CloudFlare, Inc.). VirusTotal reports that 15 out of 95 security vendors flag this domain as malicious. The SSL certificate is issued by Google Trust Services / WE1, which may lend a false sense of security to users. The domain appears on one security blocklist and has a page title of 'Trezor Bridge: Secure.'

To mitigate the risks associated with this brand impersonation threat, users are advised to verify the URL and SSL certificate of any site claiming to be associated with Trezor. Organizations should update their security awareness training to include examples of such phishing campaigns and emphasize the importance of double-checking domain names. Network administrators should consider implementing DNS filtering to block access to known malicious domains and IP addresses. Additionally, reporting the domain to Trezor and relevant authorities can help in taking further action against the threat actors.