devlop-trezer-bridge[.]pages[.]dev

Analysis of devlop-trezer-bridge.pages.dev indicates a confirmed crypto‑related brand impersonation campaign targeting users of the Trezor hardware wallet. The domain was registered on March 23, 2026 through Cloudflare, Inc., and the authoritative nameservers dahlia.ns.cloudflare.com and ray.ns.cloudflare.com resolve to the Cloudflare‑owned address 172.66.44.63, a Canadian‑based hosting location. The site presents a TLS certificate issued by Google Trust Services under the WE1 root, suggesting a legitimate‑looking HTTPS connection despite the underlying malicious intent. The page title "Trezor Bridge - Secure Connection for Trezor Devices" directly mirrors the official Trezor Bridge service, reinforcing the impersonation vector.

Infrastructure signals further corroborate malicious use: the domain receives a Gridinsoft trust score of 0 out of 100 and is listed on a single security blocklist. VirusTotal scans have flagged the domain by 17 of 94 antivirus engines, and it is actively blocked by the PhishDestroy blocklist, indicating broader detection across threat‑intelligence feeds. HTTP responses return a 403 status code, which may be a defensive measure after takedown or a deliberate barrier to casual browsing. Detected technologies include HSTS, Cloudflare CDN, and HTTP/3, all of which are typical for legitimate services but also provide anonymity and resilience for malicious operators.

While the exact content hosted on the site has not been examined, the combination of a brand‑specific page title, a crypto‑scam classification, and the observed detection metrics strongly suggest the domain is being used to lure Trezor users into supplying private keys or firmware updates. Uncertainty remains regarding the specific payload or credential‑ harvesting method employed, as no visual or script analysis is available.

Defenders should immediately add devlop-trezer-bridge.pages.