en-bridge-etr[.]pages[.]dev

A phishing domain, en-bridge-etr.pages.dev, impersonates the cryptocurrency hardware wallet brand Trezor. Detected on its creation date, April 18, 2026, this domain aims to deceive users by presenting itself as "Trezor Bridge — Secure Connection for Your Trezor." Despite being taken offline, it has been flagged by 2 out of 94 vendors on VirusTotal and listed on one public blocklist by PhishDestroy.

The domain was registered through Cloudflare, Inc., and hosted on an IP address in Canada, also managed by Cloudflare. The site's SSL certificate was issued by Google Trust Services, indicating a level of sophistication in its setup. The platform risk score for this domain is 61 out of 100, suggesting a moderate threat level during its active period.

Phishing domains like en-bridge-etr.pages.dev exploit the critical time window between domain registration and the update of antivirus databases. PhishDestroy's detection pipeline captures such threats early, before they propagate through traditional security channels. The quick takedown of this domain highlights the effectiveness of rapid detection and response efforts in combating online threats.