bridgee-tzer[.]pages[.]dev

The domain bridgee-tzer.pages.dev has been identified as a high-risk brand impersonation threat targeting Trezor, a popular cryptocurrency hardware wallet brand. The page title, "Trezor Bridge — Secure Connection Layer | Trezor Bridge," is designed to trick users into believing they are accessing a legitimate Trezor service. This is a classic phishing scheme aimed at stealing cryptocurrency wallet credentials or seed phrases through a fake login interface. No specific drainer kit has been identified, but the domain is currently active and poses an immediate risk to users.

Technical analysis reveals that bridgee-tzer.pages.dev resolves to IP address 188.114.97.3 and was registered on March 27, 2026, through Cloudflare Pages, which is often abused for hosting phishing sites. The domain has a Google Trust Services / WE1 SSL certificate, giving it a false sense of security. VirusTotal reports that 6 out of 95 security vendors flag this domain as malicious, and it appears on at least one security blocklist. It is not yet listed on Google Safe Browsing (GSB), which increases the risk of exposure to unsuspecting users.

As of this report, the domain remains active and continues to host the fraudulent Trezor Bridge page. PhishDestroy recommends that users avoid visiting the domain entirely and never enter any personal or financial information. If you have already interacted with the site, immediately change your Trezor-related credentials and enable two-factor authentication. Report the domain to Cloudflare and Google Safe Browsing to help protect others. The overall risk remains high due to the active status and the sensitivity of the targeted brand.