spark-trez-bridge[.]pages[.]dev

PhishDestroy identifies spark-trez-bridge.pages.dev as an active phishing campaign impersonating the Trezor cryptocurrency wallet service. This malicious domain mirrors the official Trezor interface to trick users into revealing recovery phrases and private keys, enabling cryptocurrency theft. The site was registered through Cloudflare, Inc. and currently resolves to IP 172.66.44.83. At the time of analysis, the domain had not been flagged by any of the 95 VirusTotal security vendors, indicating a newly emerged or sophisticated threat evasion technique. This domain poses a high-risk threat to cryptocurrency users, particularly those managing Trezor wallets. The phishing lures often arrive via email or social media, mimicking official Trezor support or urgent security alerts. The domain is hosted behind Cloudflare’s CDN, adding layers of obfuscation and complicating takedown efforts. While the SSL certificate is issued by Google Trust Services, this does not validate the site’s legitimacy—it only confirms encrypted communication with the malicious server. The absence of detections on VirusTotal (3/95) suggests this phishing campaign remains under the radar of mainstream security tools, increasing the risk of successful exploitation. Users who visited spark-trez-bridge.pages.dev should immediately scan their devices with reputable antivirus and malware removal tools. If any login credentials, recovery phrases, or private keys were entered, revoke access to affected wallets immediately and transfer funds to a new, uncompromised wallet. Enable two-factor authentication on all cryptocurrency accounts and monitor for unauthorized transactions. Report the domain to Trezor support and submit it to PhishDestroy for further analysis to aid in broader threat mitigation. Avoid interacting with this domain and warn others who may have received suspicious links referencing Trezor services.