advance-v-bridge-trazre[.]pages[.]dev

Analysis of the domain advance-v-bridge-trazre.pages.dev indicates an active brand impersonation campaign targeting Trezor users. The domain was registered on April 04, 2026 and is hosted behind Cloudflare, Inc., as evidenced by the nameservers grant.ns.cloudflare.com and tess.ns.cloudflare.com and the IP address 172.66.44.164, which resolves to a Cloudflare location in Canada. The site presents a valid TLS certificate issued by Google Trust Services under the WE1 profile, and HTTP requests return a 200 status code. Gridinsoft assigns a trust score of 0/100, reinforcing its malicious nature. VirusTotal reports 7 detections out of 94 security vendors, and the domain is listed on at least one security blocklist and has been blocked by PhishDestroy. The page title "Trezor® Bridge Guide | Secure Connection" aligns with the declared scam type of brand impersonation. No additional content has been publicly examined, so the exact phishing payload or credential‑harvesting mechanisms remain unknown. Defenders should block the domain at network perimeters, add the IP address 172.66.44.164 to deny‑list rules, and monitor for any related DNS queries or traffic patterns. Sharing this indicator with threat‑intel platforms will aid in early detection of similar Trezor‑related impersonation attempts.