connect-trez-ar-bridge[.]pages[.]dev

The domain connect-trez-ar-bridge.pages.dev is a phishing site engaged in brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. It poses an elevated risk by mimicking Trezor Bridge to deceive users into exposing sensitive information or cryptocurrency assets. No drainer kit was detected, but the site was confirmed to be part of a cryptocurrency scam. As of the latest verification, connect-trez-ar-bridge.pages.dev has been taken offline.

Technical indicators confirm the malicious nature of connect-trez-ar-bridge.pages.dev. The domain was flagged by 2 of 95 security vendors on VirusTotal, including LevelBlue and Phishing Database, and appears on 1 security blocklist (PhishDestroy). It was registered through Cloudflare, Inc. on September 19, 2025, and resolves to the IP address 188.114.96.3, hosted by Cloudflare in Canada. The SSL certificate is issued by Google Trust Services (WE1), and the observed page title was 'Trezor Bridge — Secure Connection for Your Trezor'. Technologies detected include HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100. The domain currently returns an HTTP 403 status.

Users who interacted with connect-trez-ar-bridge.pages.dev should immediately revoke any token approvals and transfer cryptocurrency funds to a new, secure wallet. Enable two-factor authentication (2FA) on all accounts and monitor for unauthorized transactions. Report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand (Trezor) to aid in takedown efforts. If credentials were entered, change passwords immediately and review connected devices for suspicious activity.