support-ttrezor-com[.]pages[.]dev

The domain support-ttrezor-com.pages.dev is currently active and serves an HTTP 200 response. Infrastructure analysis shows the site is hosted behind Cloudflare, using HSTS and HTTP/3, and resolves to the IP address 188.114.97.3 located in Canada. The domain was registered on March 26 2026 through Cloudflare, Inc., and the TLS certificate is issued by Google Trust Services under the WE1 root. Nameservers ruben.ns.cloudflare.com and ullis.ns.cloudflare.com confirm the Cloudflare hosting. The page title “Download Trezor Bridge – Secure Access to Your Hardware Wallet” and the classification as a brand‑impersonation campaign indicate the site is attempting to masquerade as an official Trezor resource. Threat intelligence places the domain on one security blocklist and it has been blocked by PhishDestroy. VirusTotal scans report 11 of 94 security vendors flagging the domain, and Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. While the exact payload or credential‑harvesting mechanism has not been publicly disclosed, the combination of brand‑specific wording, active hosting, and multiple vendor detections provides sufficient evidence for a high‑risk rating. Defenders should block the domain at network perimeters, add it to endpoint allow‑lists as malicious, and monitor for any related DNS or HTTP traffic. Continuous re‑evaluation is advised in case the site’s content changes or additional indicators emerge.