trezorbridge-eans[.]pages[.]dev

Analysis of trezorbridge-eans.pages.dev indicates a confirmed brand‑impersonation campaign targeting Google users. The domain was created on February 21, 2026 and is registered through Cloudflare, Inc., with authoritative nameservers ben.ns.cloudflare.com and addilyn.ns.cloudflare.com. DNS resolution points to IP address 172.66.47.135, which belongs to AS13335 Cloudflare, Inc., located in the United States. The site presents a valid SSL certificate issued by Google Trust Services / WE1, suggesting an attempt to lend legitimacy to the host.

HTTP response returns a 403 status code, and the presence of HSTS, Cloudflare, and HTTP/3 headers confirms the use of modern delivery infrastructure. The page title "Trezor Bridge Download – Safely Link Trezor to Trezor Suite or Web Apps" does not reference Google directly, and the actual page content has not been captured, leaving the visual phishing vector uncertain. However, the domain is flagged by PhishDestroy and appears on one additional security blocklist, and ten of ninety‑three VirusTotal scanners have identified it as malicious, reinforcing the suspicion of abuse. The Gridinsoft trust score of 0/100 further reflects a lack of trustworthiness.

The campaign is classified as a tech‑support scam, implying that victims may be lured into providing remote access or payment under the pretense of assisting with a purported Google‑related issue. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat intelligence feeds with the observed indicators, and monitor for any resurgence after the current offline status. Analysts should also watch for similarly structured domains that use Cloudflare‑hosted SSL certificates issued by Google Trust Services, as this pattern may be reused in future impersonation attempts.