project-bridge-trgr-3po[.]pages[.]dev

This domain, project-bridge-trgr-3po.pages.dev, was identified as a crypto scam impersonating Trezor, a hardware cryptocurrency wallet provider. Analysis indicates the domain was created on March 24, 2026, and was taken offline by the time of this report. The page title, 'Trezor Bridge® Presentation,' suggests an attempt to deceive users into believing the site is an official Trezor resource, though the exact content and functionality remain unconfirmed due to its offline status. Infrastructure analysis reveals the domain was hosted on Cloudflare, resolving to the IP 188.114.97.3, located in Canada. The SSL certificate was issued by Google Trust Services (WE1), and the domain employed HSTS and HTTP/3 technologies, typical of modern phishing infrastructure leveraging legitimate services to evade detection.

At the time of assessment, the domain returned an HTTP 403 status, indicating access was restricted or blocked. It appeared on one security blocklist, and 13 of 94 security vendors on VirusTotal flagged the domain as malicious. Gridinsoft assigned a trust score of 0/100, further corroborating its high-risk classification. The domain was registered through Cloudflare, Inc., and used Cloudflare nameservers (aspen.ns.cloudflare.com and everton.ns.cloudflare.com). While the specific phishing kit or payload is not identified, the combination of brand impersonation, crypto-themed scam classification, and low detection thresholds aligns with known tactics targeting cryptocurrency users.

Defenders should treat this domain as confirmed malicious. Block the domain, IP, and associated SSL certificate at network and endpoint levels. Monitor for related infrastructure, such as newly registered domains under Cloudflare Pages or similar hosting services, particularly those impersonating Trezor or other crypto brands. If logs indicate user interaction with this domain, investigate for potential credential theft or malware exposure.