tezor-bridge[.]pages[.]dev

PhishDestroy identifies tezor-bridge.pages.dev as an active brand impersonation scam targeting Trezor users. This domain masquerades as the official Trezor bridge service to deceive victims into connecting their wallets and approving fraudulent transactions. This domain poses a critical risk by impersonating Trezor’s legitimate bridge service (trezor.io/bridge). Evidence includes 0 detections out of 95 VirusTotal scans, Cloudflare Inc. as the registrar, and an SSL certificate issued by Google Trust Services. The domain resolves to IP 188.114.96.3, a known hosting infrastructure associated with malicious activity. Threat intelligence indicates this campaign is active and evolving, with no current blocklist coverage despite its malicious intent. Users who visited tezor-bridge.pages.dev should immediately disconnect their wallet if connected, revoke any unauthorized permissions via their wallet’s interface, and scan their device for malware. Do not enter credentials or interact with the site further. Report the domain to Trezor’s official channels and consider blocking the IP 188.114.96.3. Trezor users should always verify URLs via official sources before any interaction.