trrzzr-bridge[.]pages[.]dev

The domain trrzzr-bridge.pages.dev was registered on March 22, 2026 through Cloudflare, Inc. and is hosted on a Cloudflare IP address (188.114.96.3) located in Canada. The site presents the page title "Trezor Bridge: Secure" and serves over HTTPS with a certificate issued by Google Trust Services under the WE1 designation. Technical analysis shows the presence of Tailwind CSS, HTTP Strict Transport Security (HSTS), Cloudflare services and HTTP/3 support. An HTTP request returns a 403 status code, indicating that direct access is currently denied.

The infrastructure has been flagged by multiple defensive sources: PhishDestroy lists the domain as blocked, Google Safe Browsing classifies it as a social engineering threat, and it appears on one additional security blocklist. VirusTotal scans report 14 of 94 antivirus engines flagging the domain as malicious. Gridinsoft assigns a trust score of 0 out of 100. The site is identified as a crypto‑related scam that impersonates the hardware‑wallet brand Trezor.

As of the reporting date (July 24, 2026) the domain is reported offline, but the historical evidence suggests an active impersonation campaign. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑hosting attempts on the same IP range, and update detection signatures to include the observed SSL issuer and page title. Further investigation is required to determine the exact payload or phishing lures that may have been delivered before the takedown, as the current 403 response limits visibility into the content that was previously served.