get-trezer-bridge-io[.]pages[.]dev

Domain get-trezer-bridge-io.pages.dev has been flagged as a live crypto-asset drainer kit impersonating a legitimate bridge service. The site lures victims under the guise of a ‘Trezer Bridge’ withdrawal portal, delivering a JavaScript-based drainer to siphon wallet assets once connected. No branded target is discernible; the campaign appears opportunistic, leveraging a generic ‘bridge’ theme to capture crypto users searching for alternative transaction routes. The payload structure and social engineering prompts align with documented drainer-as-a-service kits observed in early 2024 campaigns. Seed 004709 indicates this variant may be part of a broader rotation through Pages.dev subdomains to evade detection.

PhishDestroy analysis reveals the domain resolves to IP 188.114.97.3 via Cloudflare infrastructure. As of the latest scan, VirusTotal shows 3/95 detection engines flagging the domain or its payload, despite its active deployment. The domain was registered through Cloudflare, Inc., and operates under a Google Trust Services SSL certificate, adding superficial legitimacy. The Pages.dev subdomain suggests rapid deployment cycles, likely automated via GitHub Pages integration to create disposable phishing fronts. This configuration enables fast takedown evasion and geographic dispersion of C2 endpoints hidden behind Cloudflare’s proxy. No prior blocklist entries were detected in public feeds at time of analysis, indicating fresh deployment.

This domain remains active as of real-time monitoring with seed 004709 confirming continued operation. Immediate response actions include notifying Cloudflare Trust & Safety, Google Trust Services for certificate revocation, and updating enterprise blocklists. Users are advised to block the domain at DNS and network levels and avoid interacting with any ‘bridge’ or ‘swap’ services promoted via unsolicited links. Remaining risk is assessed as HIGH due to active drainer deployment, low detection coverage, and use of reputable infrastructure layers. Users should verify all crypto bridge URLs through official project channels and use hardware wallets with transaction simulation features to detect unauthorized fund drains.