begin-trezr-bridgedocs[.]pages[.]dev

Security teams have identified begin-trezr-bridgedocs.pages.dev as an active phishing domain masquerading as a cryptocurrency wallet bridge interface. Users attempting to connect wallets or transfer funds via this page risk credential theft, private key exposure, or direct fund siphoning to attacker-controlled addresses. The page leverages HTTPS via Google Trust Services to appear legitimate, while the underlying infrastructure—hosted on Cloudflare at 188.114.96.3—facilitates rapid deployment and evasion of traditional network defenses. This domain has not yet been flagged by security vendors, remaining undetected across 8 out of 95 engines on VirusTotal at time of analysis. It is registered through Cloudflare, Inc., a common choice for threat actors seeking anonymity and fast propagation. While the exact registration date is not publicly available, the domain uses Cloudflare Pages, a platform frequently abused for phishing due to its legitimate appearance and short-lived infrastructure cycles. If you or your organization have visited begin-trezr-bridgedocs.pages.dev, immediately disconnect any connected wallets, revoke permissions via blockchain explorers, and scan endpoints for unauthorized crypto-related tooling. Report the domain to your SOC and block 188.114.96.3 at the firewall. Treat any entered credentials or private keys as compromised and rotate them immediately. Monitor on-chain transactions for unauthorized transfers and consider engaging incident response for forensic analysis.