bridge-trezzar-c57[.]pages[.]dev

Nine out of 94 security vendors on VirusTotal flag bridge-trezzar-c57.pages.dev as malicious. The domain, now offline, impersonated Trezor, a popular cryptocurrency hardware wallet brand. It was registered through Cloudflare, Inc., and hosted on an IP in Canada. PhishDestroy added it to public blocklists on the same day it was detected.

The phishing site mimicked Trezor's official branding, using a page title that falsely claimed to be the 'Secure Gateway to Your Hardware Wallet®'. This tactic aimed to deceive users into entering their sensitive credentials, potentially leading to financial loss. The domain utilized an SSL certificate issued by Google Trust Services, which may have lent it a false sense of legitimacy.

PhishDestroy's early detection highlights the importance of rapid response to phishing threats. The domain was identified and taken down on its creation date, April 3, 2026. Despite its swift removal, the incident underscores the ongoing risk posed by phishing sites that exploit brand trust. The platform risk score of 68 out of 100 indicates a significant threat level during its active period.

This case exemplifies how phishing domains can quickly emerge and deceive users before comprehensive detection by antivirus databases. PhishDestroy's proactive measures help mitigate such risks by identifying threats during the critical early window before widespread AV coverage.