bridge-trezor[.]plasmic[.]run

The domain bridge-trezor.plasmic.run was identified as a brand impersonation phishing site specifically targeting Trezor, a well-known hardware wallet provider. This domain is currently offline, which reduces the immediate risk to users, but it represents a significant threat to those who may have encountered it while it was active. The site was designed to deceive users into believing they were accessing the legitimate Trezor Bridge service, thereby potentially capturing sensitive credentials or wallet information.

Technical analysis reveals that bridge-trezor.plasmic.run resolves to the IP address 216.150.16.1 and was registered through Amazon Registrar, Inc. According to VirusTotal, the domain was flagged by 22 out of 95 security vendors, indicating a high level of malicious consensus across the security community. Additionally, the domain appears on three security blocklists, further confirming its malicious nature. The SSL certificate for the site was issued by Let's Encrypt, which is commonly used by both legitimate and malicious sites due to its free and automated issuance process. The page title observed was "Trezor Bridge – The Secure Gateway to Your Hardware Wallet," which closely mimics the official Trezor Bridge service.

Given that the domain is now offline, the immediate threat is neutralized. However, PhishDestroy recommends that users who may have visited this site or provided any information should take proactive steps to secure their accounts. This includes changing passwords for any associated services, enabling two-factor authentication, and monitoring for unauthorized activity. It is also advisable to only access Trezor services through official channels and to verify URLs carefully before entering sensitive information. Staying informed about such phishing campaigns helps users avoid falling victim to similar attacks in the future.