tresor-bridge-ens[.]pages[.]dev

The domain tresor-bridge-ens.pages.dev was registered on April 09, 2026 through Cloudflare, Inc., using the authoritative nameservers gabe.ns.cloudflare.com and susan.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. and is located in Canada. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid TLS chain but offering no indication of legitimacy. An HTTP request returns a 403 status, suggesting that the content is not publicly accessible at the time of analysis, and the domain is currently listed as offline.

Security telemetry shows that eight of ninety‑four VirusTotal scanners flagged the domain, and it appears on a single external blocklist. PhishDestroy has explicitly blocked the domain, and the Gridinsoft trust score is 0 out of 100, while Scamadviser rates it at 41 out of 100. The page title observed during the brief fetch attempt reads “Seamless Integration: Using Trezor Bridge for Secure Web3 Interactions,” which references the Trezor Bridge product but the brand target in the intelligence is Trust Wallet. This mismatch, combined with the classification as an investment scam, indicates a deliberate brand‑impersonation attempt aimed at cryptocurrency users.

The available evidence confirms that the infrastructure is hosted behind Cloudflare’s network, a common choice for malicious actors seeking anonymity and rapid deployment. The low trust scores, multiple vendor detections, and blocklist listings collectively support a high confidence assessment that the domain is being used for a brand‑impersonation investment scam against Trust Wallet users. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat‑intelligence feeds, and monitor for any resurrection of the site under the same IP or similar subdomains.