sse-tresor-bridge[.]pages[.]dev

On 23 March 2026 the domain sse-tresor-bridge.pages.dev was registered through Cloudflare, Inc. The domain resolves to the Cloudflare edge IP 172.66.44.135, which is geolocated to Canada and is served by Cloudflare’s infrastructure (nameservers junade.ns.cloudflare.com and priscilla.ns.cloudflare.com). The TLS certificate presented is issued by Google Trust Services under the WE1 certificate authority, indicating a valid‑looking HTTPS endpoint. HTTP requests return a 403 status code, and the server advertises HSTS and HTTP/3 support, consistent with modern Cloudflare deployments. The site’s page title, “Trezor Bridge — Install, Configure”, directly references the hardware‑wallet brand Trezor, and the known intelligence tags the domain as an impersonation of that brand.

The scam type is identified as a crypto scam, suggesting the page is intended to lure cryptocurrency users. VirusTotal has recorded 16 detections out of 94 scanning engines, confirming that multiple security products flag the domain as malicious. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the domain, and it is currently listed as offline.

Evidence confirms the domain’s malicious intent, but the exact content served before takedown has not been captured, leaving the specific phishing workflow uncertain. No additional intelligence such as OTX references or malware kit identifiers is available. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any related sub‑domains under the pages.dev namespace, and update endpoint protection signatures to include the observed VirusTotal detections. Given the active use of Cloudflare’s infrastructure, threat hunters should also consider reviewing logs for outbound connections to IP 172.66.44.135 that may indicate compromised clients attempting to reach the impersonation site.