trzo-bridgge[.]pages[.]dev

Analysis of the domain trzo-bridgge.pages.dev indicates active brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. The domain was registered on April 24, 2026, through Cloudflare, Inc., and remains operational as of July 12, 2026, returning an HTTP 200 status. Infrastructure analysis reveals the domain is hosted on Cloudflare infrastructure, resolving to the IP address 188.114.97.3, located in Canada. Nameservers penny.ns.cloudflare.com and west.ns.cloudflare.com are associated with the domain, and technologies such as HSTS and HTTP/3 are detected. The SSL certificate is issued by Google Trust Services, with the identifier WE1. The page title, 'Trezor Bridge — Clear, Colorful Presentation,' explicitly references Trezor, aligning with the known scam type of brand impersonation. Security vendor assessments show limited but concerning detection: two of 94 vendors on VirusTotal flag the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on at least one security blocklist, and an independent detection service has already classified it as malicious. While the exact content and functionality of the site have not been analyzed, the combination of brand-specific page title, low trust scores, and blocklist inclusion strongly suggests an attempt to deceive users into interacting with fraudulent infrastructure. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where Trezor-related services are used. Further investigation into associated IP ranges and certificate issuance patterns may reveal additional linked infrastructure.