suites-apps-trezr[.]pages[.]dev

PhishDestroy identifies suites-apps-trezr.pages.dev as a live cryptocurrency wallet drainer deployed on a Cloudflare Pages subdomain. The page masquerades as a legitimate ‘suites-apps-trezr’ suite but is a malicious endpoint harvesting private keys and signing transactions on behalf of victims. Security vendors have not yet flagged the domain—VirusTotal shows 0 detections out of 95 engines—indicating a recent or stealthily instrumented campaign. This domain resolves to IP 188.114.97.3, is registered through Cloudflare, Inc., and holds a Google Trust Services SSL certificate. The infrastructure is clean on first inspection: zero VirusTotal detections, one known IP, Cloudflare fronting, and a valid Google-issued certificate. These characteristics suggest the threat actor is leveraging Cloudflare’s free tier and Google’s TLS ecosystem to blend in with benign SaaS deployments. Current status remains active; no takedown or blocklisting has occurred yet. Users are advised to block access at the network level, avoid visiting the page, and report the domain to abuse channels. Risk remains elevated until detection coverage increases or the site is sinkholed. Remain vigilant when receiving links purporting to be crypto-suite updates—this strain specifically targets wallet credentials.