home-bridge-com[.]pages[.]dev

Analysis of home-bridge-com.pages.dev indicates a confirmed brand impersonation campaign targeting Trezor users. The site presented the title "Trezor Bridge — Browser to Device Connector", matching the official product name, and was registered on April 19, 2026 through Cloudflare, Inc. The authoritative nameservers are chuck.ns.cloudflare.com and violet.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. DNS resolution points to IP 172.66.47.11, an address owned by Cloudflare, Inc. and geolocated to Canada. The TLS certificate issued by Google Trust Services under the WE1 trust scheme validates the HTTPS connection, while HTTP headers confirm enforcement of HSTS and use of HTTP/3, consistent with Cloudflare’s edge platform. VirusTotal scanned the domain and recorded three positive detections out of ninety‑four submitted security vendors, indicating that multiple scanners have identified malicious characteristics.

Independent reputation services assign a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist. Defensive infrastructure such as PhishDestroy has already taken the site offline, and an HTTP 403 response is returned for current requests. The overall risk rating is listed as elevated. Observable evidence confirms the use of legitimate cloud infrastructure to host a brand‑impersonating page, a tactic that can lend credibility to phishing attempts. However, the content of the page beyond the title has not been captured, leaving the exact user‑interaction flow uncertain.

No additional indicators such as payload hashes, downloader URLs, or command‑and‑control endpoints have been disclosed. Defenders should block the domain at network perimeter and ensure that endpoint protection solutions reference the observed VirusTotal detections. Monitoring for newly created Cloudflare‑hosted subdomains that mimic Trezor‑related terminology is advisable, as the same infrastructure could be reused.