connect-trezarr-bridge[.]pages[.]dev

The domain connect-trezarr-bridge.pages.dev is a phishing site engaged in brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. It posed as a legitimate Trezor Bridge service to deceive users into exposing sensitive information or cryptocurrency assets. No drainer kit was identified, but the site operated as a cryptocurrency scam. As of the latest verification, connect-trezarr-bridge.pages.dev has been taken offline.

Technical indicators confirm its malicious nature: 2 of 95 VirusTotal security vendors flagged the domain, including LevelBlue and Phishing Database. It appeared on 1 security blocklist (PhishDestroy) but was not flagged by Google Safe Browsing. The domain was registered through Cloudflare, Inc. on September 20, 2025, and resolved to the IP address 188.114.97.3, hosted by Cloudflare in Canada. The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Trezor Bridge – Secure Connection'. Additional technologies detected include HSTS, Cloudflare, and HTTP/3. The domain’s nameservers were craig.ns.cloudflare.com and vida.ns.cloudflare.com, and it returned an HTTP 403 status at the time of assessment.

Users who interacted with connect-trezarr-bridge.pages.dev should immediately revoke any token approvals granted to unknown contracts and transfer cryptocurrency funds to a new, secure wallet. If login credentials were entered, change passwords for associated accounts and enable two-factor authentication. Report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand’s security team to aid in takedown efforts.