trezu-bridge[.]pages[.]dev

The domain trezu-bridge.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. It posed as a legitimate 'Trezor Bridge' service to deceive users into exposing sensitive information or transferring cryptocurrency under false pretenses. No drainer kit was identified, but the site operated as a cryptocurrency scam. As of the latest verification, trezu-bridge.pages.dev has been taken offline.

Technical indicators confirm the malicious nature of trezu-bridge.pages.dev. The domain was flagged by 2 of 95 security vendors on VirusTotal, including LevelBlue and Phishing Database, and appeared on 1 security blocklist (PhishDestroy). Registered through Cloudflare, Inc. on September 26, 2025, it resolved to the IP address 172.66.44.79, hosted by Cloudflare in Canada. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'trezor bridge'. Technologies detected included HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100. Google Safe Browsing did not flag the domain at the time of analysis.

Users who interacted with trezu-bridge.pages.dev should immediately revoke any token approvals granted to unknown contracts and transfer cryptocurrency to a new, secure wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication (2FA). Monitor accounts for unauthorized transactions and report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand’s security team. Victims may also file complaints with local cybercrime authorities or organizations like the FBI’s IC3.