bcg-tresor-bridge[.]pages[.]dev

PhishDestroy identifies bcg-tresor-bridge.pages.dev as a high-risk domain engaged in active brand impersonation targeting the Trezor cryptocurrency wallet ecosystem. This fraudulent page leverages a spoofed Trezor Bridge interface to deceive users into downloading counterfeit software or divulging sensitive credentials. The attack employs a convincing Trezor-themed visual design, including a fabricated page title—'Trezor Bridge — New Different Logo Styles'—to lend false legitimacy to the phishing lure. While no custom drainer kit has been confirmed in this instance, the page’s structure suggests it may redirect victims to a secondary payload designed for credential theft or cryptocurrency fund siphoning. This domain resolves to IP address 172.66.46.236 and operates under a Google Trust Services SSL certificate, likely to evade browser-based warnings. Registered via Cloudflare, Inc., it currently remains active despite minimal detection coverage, with only 1 out of 95 VirusTotal security vendors flagging the URL as malicious. The domain’s recent creation date and use of a trusted certificate authority underscore the sophistication of this impersonation campaign. Notably, it has not yet been flagged by Google Safe Browsing (GSB), and its presence on public blocklists remains limited, increasing its potential reach among unsuspecting users. At present, bcg-tresor-bridge.pages.dev continues to operate undetected, posing an ongoing risk to Trezor users and cryptocurrency holders. Immediate response actions include updating network blocklists, flagging the domain in DNS filtering systems, and issuing user advisories to avoid interacting with the page. Remaining risk factors include the domain’s active status, lack of widespread detection, and the likelihood of further refinement to evade security measures. Organizations are advised to monitor for related infrastructure, block the IP and domain at the perimeter, and educate users on verifying official Trezor channels before downloading software or entering credentials.