trezor-usa-bridge[.]pages[.]dev

This domain, trezor-usa-bridge.pages.dev, operates as a high-risk brand impersonation phishing site targeting users of the Trezor hardware wallet. Analysis indicates the site is designed to mimic legitimate Trezor authentication portals, likely deploying crypto drainer scripts to harvest wallet credentials and private recovery phrases. The infrastructure is engineered to deceive users into entering sensitive cryptographic keys under the pretense of wallet synchronization or security verification, resulting in unauthorized asset transfers upon credential submission.

Technical evidence confirms the domain’s malicious intent through multiple indicators. The domain was registered on October 09, 2025, via Cloudflare, Inc., and resolves to the IP address 172.66.44.236, associated with Cloudflare’s AS13335. VirusTotal detection metrics report 15 out of 95 security vendors flagging the domain as malicious, while four independent security blocklists—PhishDestroy, MetaMask, SEAL, and PhishingDB—have actively blocked access. The SSL certificate, issued by Google Trust Services (WE1), further aligns with patterns observed in transient phishing infrastructure, where legitimate certificate authorities are exploited to lend false credibility to fraudulent endpoints.

Users who visited trezor-usa-bridge.pages.dev and entered wallet credentials, recovery phrases, or private keys are at immediate risk of asset compromise. Affected individuals should immediately transfer remaining funds to a new, secure wallet address and generate fresh recovery phrases. All connected devices should undergo a full malware scan to detect potential secondary payloads or persistent threats. Wallet software should be reinstalled from verified sources, and multi-factor authentication should be enabled on all associated accounts. Users are advised to monitor transaction histories for unauthorized activity and report the incident to relevant cryptocurrency security response teams for further mitigation.