homepage-brdgetrzr[.]pages[.]dev

This domain, homepage-brdgetrzr.pages.dev, is actively impersonating Trezor, a cryptocurrency hardware wallet provider, as indicated by the page title 'Trezor Bridge — Secure & Smooth Crypto Access' and the brand target classification. Infrastructure analysis reveals the domain was registered on October 24, 2025, through Cloudflare, Inc., and currently resolves to the IP address 172.66.44.77, hosted in Canada. The domain uses Cloudflare nameservers (meera.ns.cloudflare.com and watson.ns.cloudflare.com) and is secured with a Google Trust Services SSL certificate (WE1). Technologies detected include HSTS, Cloudflare, and HTTP/3, which are consistent with modern phishing infrastructure designed to evade detection and appear legitimate. As of July 12, 2026, the domain remains active with an HTTP 200 status, indicating it is serving content. It has been flagged by 11 out of 91 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy. The Gridinsoft trust score of 0/100 further supports its classification as malicious. While the exact content of the phishing page has not been analyzed, the combination of brand impersonation, recent registration, and security vendor detections suggests it is likely targeting users of Trezor products, potentially to harvest credentials or distribute malicious software. Defenders should prioritize blocking this domain at the DNS and network levels. Given its association with Cloudflare Pages, monitoring for newly created subdomains under the same service may help identify related phishing infrastructure. The domain's use of Cloudflare's CDN and security features may complicate takedown efforts, so coordination with the hosting provider and relevant security teams is recommended. No evidence currently links this domain to broader campaigns, but defenders should remain vigilant for similar impersonation attempts targeting cryptocurrency-related services.