bridge-trazra-3nm[.]pages[.]dev

Analysis of bridge-trazra-3nm.pages.dev indicates an active brand‑impersonation campaign targeting Trezor users. The domain was registered on April 04, 2026 and is hosted behind Cloudflare, Inc. infrastructure; DNS resolution points to IP 188.114.97.3, located in Canada and associated with Cloudflare. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 framework, which may lend superficial legitimacy. Gridinsoft assigns a trust score of 0/100, and VirusTotal reports that 6 of 94 scanners flag the domain, reflecting a modest detection rate. The page title "Trezor Bridge — Definitive Guide & Reference" aligns with the claimed brand target, confirming the impersonation intent. The domain is listed on one security blocklist and is currently blocked by PhishDestroy, yet the HTTP response remains 200, indicating the page is still reachable. Nameservers brady.ns.cloudflare.com and gracie.ns.cloudflare.com confirm Cloudflare name service usage. No additional forensic artifacts (malware payloads, credential‑stealing forms, or redirects) have been disclosed. Defenders should continue to block the domain at perimeter controls, monitor DNS queries for 188.114.97.3, and advise users to avoid any unsolicited Trezor‑related links originating from this host. Ongoing observation is recommended to detect any evolution of the infrastructure or emergence of new malicious payloads.