tarzir-started[.]pages[.]dev

PhishDestroy identifies tarzir-started.pages.dev as a live crypto drainer domain engineered to siphon cryptocurrency from unsuspecting users. The page hosts a counterfeit deposit interface that prompts victims to connect wallets under the guise of receiving rewards, then silently drains funds via malicious smart-contract interactions. Once a wallet is linked, the drainer immediately initiates token transfers to attacker-controlled addresses, often camouflaged as gas fees or small test transactions to avoid triggering wallet alerts. This domain was flagged by PhishDestroy’s pipeline after resolving to 188.114.97.3 and showing 0 detections on VirusTotal out of 95 engines at the time of analysis. The infrastructure is hosted behind Cloudflare, Inc., which obscures origin details and complicates takedown efforts, while the SSL certificate issued by Google Trust Services lends false legitimacy to the page. The domain is currently active and under continuous monitoring, with no known blocklist entries at this stage, indicating it remains in early operational phases. Users who visited tarzir-started.pages.dev should immediately disconnect any wallets, revoke any unauthorized permissions via blockchain explorers or wallet interfaces, and scan devices for infostealers. If funds were drained, file a report with local cybercrime units and blockchain forensics teams using transaction hashes and wallet addresses. Avoid reusing seed phrases or private keys across services and consider hardware wallets for enhanced protection against future drainer campaigns.