brdge-io-trzor[.]pages[.]dev

The domain brdge-io-trzor.pages.dev is flagged as a high‑risk brand‑impersonation campaign targeting Trezor. The site presents the page title “Trezor Bridge — Definitive Guide,” which aligns with the declared brand target. DNS resolution points to IP 172.66.44.91, an address owned by Cloudflare, Inc. in Canada. The domain was registered on 30 March 2026 through Cloudflare, Inc., and uses Cloudflare nameservers mustafa.ns.cloudflare.com and rosalie.ns.cloudflare.com. TLS termination is provided by Google Trust Services under the WE1 certificate, and the server advertises HSTS and HTTP/3, returning HTTP 200 for the request. Reputation metrics indicate a Gridinsoft trust score of 0 / 100 and a VirusTotal detection rate of 6 out of 94 scanners. The domain appears on a single public blocklist and is currently blocked by PhishDestroy. While the page content beyond the title has not been examined, the combination of brand‑specific title, recent registration, Cloudflare‑hosted infrastructure, and multiple vendor detections suggests a deliberate attempt to lure Trezor users. Defenders should add the domain to URL filtering rules, monitor DNS queries for the associated IP address, and consider extending blocklist coverage. Ongoing observation of any additional indicators, such as changes to the page content or new detections, is recommended to maintain situational awareness.