help-trzurr-us[.]pages[.]dev

PhishDestroy identifies help-trzurr-us.pages.dev as an active cryptocurrency drainer phishing domain designed to steal wallet credentials and digital assets. This fraudulent site masquerades as a legitimate support portal to trick victims into connecting their crypto wallets, where malicious smart contracts silently drain funds to attacker-controlled addresses. The domain leverages Cloudflare's infrastructure to evade traditional detection, resolving to IP 188.114.96.3 while presenting a fraudulent SSL certificate issued by Google Trust Services to appear legitimate. Threat actors commonly deploy such domains in social media impersonation campaigns targeting crypto users seeking support. This domain was flagged by PhishDestroy with 0 detections out of 95 VirusTotal engines scanning the page as of the latest analysis. The domain is registered through Cloudflare, Inc., indicating intentional privacy protection to conceal the threat actor's identity. The active status combined with zero detections represents a critical gap in automated protection systems, making manual intervention essential for potential victims. The combination of Google Trust Services SSL certificate and Cloudflare hosting creates a deceptive trust signal that bypasses common browser warnings for unsuspecting users. If you visited help-trzurr-us.pages.dev, disconnect your wallet immediately and revoke any connected permissions through your wallet's connection management interface. Do not interact with any prompts or transactions generated by this domain. Report the domain to your wallet provider and relevant crypto exchanges. Clear browser cache and cookies, then run a full antivirus scan. Consider reporting the domain to Cloudflare abuse channels and Google Safe Browsing to help protect others from this crypto drainer scam.