homepage-bridge-us-en[.]pages[.]dev

This domain, homepage-bridge-us-en.pages.dev, is actively flagged for high-risk brand impersonation targeting Trezor, a hardware wallet provider. Registered on April 30, 2026, through Cloudflare, Inc., the domain resolves to IP address 172.66.47.73 and is hosted on infrastructure utilizing HSTS, Cloudflare, and HTTP/3 technologies. The page title, 'Trezor Bridge — The Secure Gateway to Your Hardware Wallet,' explicitly mimics Trezor’s official branding, aligning with the reported threat type of brand impersonation. Analysis indicates the domain appears on at least one security blocklist and is currently blocked by PhishDestroy. A Gridinsoft trust score of 0/100 further corroborates its suspicious nature. While the SSL certificate is issued by Google Trust Services, this alone does not mitigate the risk, as malicious actors frequently leverage legitimate certificates to lend credibility to fraudulent sites. Ten of ninety-five security vendors on VirusTotal have flagged this domain, though the absence of additional context limits definitive conclusions about the specific payload or attack vector. Defenders should treat this domain as an active threat. Immediate actions include blocking the domain and its resolving IP at the network perimeter, monitoring for user interactions, and alerting affected stakeholders. Given the domain’s association with hardware wallet infrastructure, potential risks include credential theft, malware distribution, or unauthorized access to cryptocurrency assets. Further investigation into related domains or IPs may uncover broader campaign infrastructure. The domain remains active as of July 12, 2026, and no takedown efforts have been observed.