bridge-trzer-us[.]pages[.]dev

PhishDestroy identifies bridge-trzer-us.pages.dev as an active crypto drainer phishing domain. The page impersonates a legitimate cloudfront service to deceive users into connecting crypto wallets and authorizing malicious transactions. No specific drainer kit has been observed in open-source reporting, but the domain’s behavior aligns with known crypto wallet-draining campaigns that trick users into signing malicious transactions. The campaign is likely designed for immediate financial theft, using urgency and impersonation to bypass user skepticism.

This domain was flagged via seed 9ab68f. Technical indicators confirm its malicious intent: it currently shows 3/95 detections on VirusTotal, indicating it remains undetected by most antivirus engines. It is registered through Cloudflare, Inc., resolving to IP 188.114.97.3, with a Google Trust Services SSL certificate. The current risk level is under investigation, yet the infrastructure and cryptographic validation suggest preparation for higher-profile abuse. No blocklist status is available at this time, emphasizing the need for rapid containment.

At present, the campaign is classified as active with a status of under_investigation. Immediate defensive actions include blocking the domain and IP at the DNS and network levels to prevent user exposure. Users are advised to avoid interacting with the domain or any pages hosted on 188.114.97.3. Remaining risk is assessed as moderate due to undetected status and cloudflare-backed infrastructure, which increases credibility with inexperienced users. Continuous monitoring is required until the domain is fully analyzed or sinkholed.