trezo-bridge-home[.]pages[.]dev

PhishDestroy identifies trezo-bridge-home.pages.dev as an active brand impersonation crypto drainer that is actively mimicking Trezor’s official Bridge service. The domain uses a deceptive page title reading Trezor® Bridge Guide | Secure Connection and Secure Crypto Connection to trick visitors into believing it is an authentic resource. This fraudulent site was first flagged on 2024-05-12 and has since remained online, resolving to IP 172.66.47.119, which is hosted behind Cloudflare’s proxy network. At the time of assessment, VirusTotal shows 0 detections out of 95 scanners, indicating it currently evades most automated detection systems. This threat analysis confirms the domain is a crypto drainer specifically designed to steal cryptocurrency by impersonating Trezor’s official Bridge software. The site’s SSL certificate is issued by Google Trust Services, which adds a false veneer of legitimacy. The domain was registered through Cloudflare, Inc., which is commonly used by threat actors to obscure hosting origins and evade takedowns. The impersonation targets users seeking secure crypto connections, luring them into downloading malicious software or entering sensitive credentials on a counterfeit interface. If you visited trezo-bridge-home.pages.dev or entered any information, immediately disconnect your device from the internet and run a full antivirus scan. Do not use the device for cryptocurrency transactions. If you downloaded any files from the site, delete them and revoke any app permissions granted to untrusted software. Report the incident to Trezor support at support@trezor.io and consider transferring remaining funds to a newly secured wallet. Always verify the URL matches trezor.io and look for the verified badge before downloading official software.