trazer[.]pages[.]dev

Analysis of the domain trazer.pages.dev indicates an active brand‑impersonation campaign targeting Trezor. The domain was registered on 2026‑04‑14 through Cloudflare, Inc. and uses Cloudflare nameservers (armando.ns.cloudflare.com, grannbo.ns.cloudflare.com). DNS resolution points to IP 188.114.97.3, a Cloudflare‑owned address located in Canada. The site serves HTTP 200 responses, enforces HSTS, and supports HTTP/3, with an SSL certificate issued by Google Trust Services / WE1. The page title returned is “Trezor Bridge® — Browser‑to‑Device Connector | Guide & Setup,” directly referencing the official Trezor Bridge product. The domain carries a Gridinsoft trust score of 0/100 and is listed on a single security blocklist; it is also blocked by PhishDestroy. No malware detections have been reported by VirusTotal, but the absence of detections does not imply safety. Current intelligence lacks details on page content, form fields, or credential‑harvesting mechanisms, so the exact malicious payload remains unknown. Defenders should treat the domain as malicious, enforce DNS‑level blocking, add it to web‑filtering and intrusion‑prevention policies, and monitor for any outbound connections to the Cloudflare IP. Continuous observation of traffic patterns and periodic re‑scanning are recommended to detect any future changes in the site’s behavior.