log-tzer-bridg-run[.]pages[.]dev

This domain, log-tzer-bridg-run.pages.dev, presents a high-risk brand impersonation threat targeting users of Trezor cryptocurrency hardware wallets. The page mimics the official Trezor Bridge software under the title 'NOTICE — Unofficial Guide: Trezor Bridge (Educational)', likely designed to deceive users into downloading malicious software or disclosing sensitive credentials. The educational framing serves as a social engineering tactic to lower user vigilance, increasing the likelihood of successful compromise of wallet access or installation of unauthorized firmware. Analysis indicates the domain was registered on March 25, 2026, through Cloudflare Pages infrastructure, resolving to IP address 188.114.97.3. It appears on one security blocklist and is flagged by 5 out of 95 security vendors on VirusTotal, including detection for phishing or malicious content. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious Cloudflare-hosted sites. Infrastructure analysis reveals the IP is geolocated in Canada and associated with Cloudflare, Inc., a provider frequently leveraged by threat actors to obscure origin servers and evade takedown efforts. Users who have visited log-tzer-bridg-run.pages.dev or interacted with its content should immediately cease all activity on the site. If credentials were entered or software downloaded, affected devices should be isolated and scanned for malware using updated security tools. Cryptocurrency wallet users are advised to verify all transactions and consider migrating funds to a new wallet if compromise is suspected. Trezor users should only download software from the official trezor.io domain and verify digital signatures before installation. Ongoing monitoring for unauthorized access attempts or unusual network activity is recommended.