trzior-bridg[.]pages[.]dev

Analysis of trzior-bridg.pages.dev shows a newly registered domain created on March 23 2026 that is hosted on Cloudflare’s network (IP 172.66.44.181, location CA). The domain resolves to a Cloudflare‑owned address and uses Cloudflare‑provided nameservers (amos.ns.cloudflare.com, izabella.ns.cloudflare.com). SSL termination is performed by Google Trust Services (certificate WE1) and the site enforces HSTS and HTTP/3. An HTTP request returns status code 403, indicating that the page is not serving content to the requesting client at the time of analysis. The page title observed in earlier crawls reads “Trezor Bridge | Connect Your Hardware Wallet Securely”, and the domain is explicitly marked as impersonating the Trezor brand.

The threat classification in the intelligence is “Crypto Scam” and the domain appears on a single security blocklist, where it has been flagged by PhishDestroy. Reputation services assign extremely low trust scores: Scamadviser 1/100 and Gridinsoft 0/100. VirusTotal scans report three detections out of ninety‑four vendor engines, confirming malicious intent. The combination of brand impersonation, a crypto‑related lure, and low reputation scores indicates a high likelihood that the site was used to harvest credentials or private keys for hardware wallets. Uncertainty remains regarding the current content because the site now returns HTTP 403 and is listed as taken offline.

No additional indicators such as phishing‑page snapshots or malware payloads have been published. Defenders should update URL filtering rules to block trzior-bridg.pages.dev at the DNS and proxy layers, add the IP 172.66.44.181 to threat‑intelligence feeds, and monitor for any newly observed subdomains under the same Cloudflare account. Incident response teams should also advise users of Trezor hardware wallets to verify official URLs and to disregard any unsolicited requests that reference “Trezor Bridge”.