bridg--trzor[.]pages[.]dev

PhishDestroy identifies bridg--trzor.pages.dev as an active generic phishing domain masquerading as a cryptocurrency wallet service. The domain employs a double-hyphen obfuscation technique ('bridg--trzor') to mimic the legitimate 'Bridge' protocol branding, targeting users seeking crypto wallet services. No specific drainer kit or cloned assets were observed in the current analysis, suggesting a preliminary phishing setup likely aimed at credential harvesting or cryptocurrency theft.

This domain resolves to IP 172.66.47.125 and is registered through Cloudflare, Inc., leveraging Google Trust Services for its SSL certificate. VirusTotal currently shows 2/95 detections, indicating evasion against signature-based detection systems. The domain is newly registered under Cloudflare’s Pages.dev platform, with no historical data available, and remains unlisted on Google Safe Browsing (GSB) and major blocklists as of this investigation. The risk level is marked as under_investigation due to limited telemetry and the absence of established threat actor fingerprints.

The domain remains active with no confirmed takedown or blocklist mitigation at this time. Users are advised to exercise extreme caution when encountering pages.dev subdomains promoting cryptocurrency services, especially those with obfuscated naming conventions. Immediate defensive actions include network-level blocking of the IP (172.66.47.125) and domain (bridg--trzor.pages.dev), alongside user awareness campaigns highlighting the risks of fake wallet phishing campaigns. Remaining risk is elevated due to the lack of detection signatures and the potential for rapid propagation across social engineering vectors. Regular re-evaluation of threat intelligence is recommended as this campaign matures.