app-trzr-bridg-download[.]pages[.]dev

PhishDestroy identifies app-trzr-bridg-download.pages.dev as a live brand-impersonation page masquerading as the official Trezor Bridge installer. The domain intentionally copies Trezor’s download page title, “How Can You Safely Complete the Trezor Bridge Download?”, to trick users into downloading malicious software that harvests cryptocurrency wallet seed phrases. The page resolves to Google Cloud IP 188.114.96.3, carries a Google Trust Services SSL certificate, and remains unflagged on VirusTotal with zero detections out of 95 scanners. Registrar records show Cloudflare, Inc. as the listed provider, confirming the attacker’s use of cloud infrastructure to evade takedowns. This threat is classified as active brand impersonation under investigation, with a current risk level still being evaluated. The site exploits user trust in the Trezor brand and leverages Pages.dev’s free subdomain service to lower barriers to entry for phishing campaigns. Despite zero VirusTotal detections, the domain’s precise targeting and exact title mimicry indicate a sophisticated, purpose-built trap aimed at cryptocurrency users seeking legitimate wallet software. The lack of detections suggests either a very new campaign or evasion techniques undetected by conventional scanners. If you have already visited app-trzr-bridg-download.pages.dev, immediately disconnect your device from the internet, run a full antivirus scan, and verify the integrity of your Trezor device and seed phrase storage. Do not enter any recovery phrases, private keys, or wallet passwords on the site. Instead, download Trezor Bridge only from the official website trezor.io and confirm the correct domain spelling and HTTPS certificate. Report any unauthorized transactions to your wallet provider and consider transferring funds to a new, verified wallet if you suspect compromise.