trazor-io-in-com[.]pages[.]dev

This domain, trazor-io-in-com.pages.dev, is confirmed to host a crypto wallet drainer phishing scheme designed to trick users into connecting their digital wallets to malicious smart contracts. The attack vector involves impersonating legitimate wallet interfaces or decentralized application (dApp) frontends, prompting victims to sign transactions that transfer assets to attacker-controlled addresses. Analysis of the domain reveals it is structured to mimic authentic wallet services, likely targeting users of popular blockchain networks such as Ethereum or Binance Smart Chain. The threat is particularly insidious due to its reliance on social engineering and the irreversible nature of blockchain transactions once executed. Infrastructure analysis reveals the domain is registered through a cloud-based hosting provider and resolves to the IP address 172.66.47.92. The SSL certificate is issued by Google Trust Services, a common tactic to lend an air of legitimacy to phishing sites. At the time of assessment, the domain remains active and is flagged by 14 out of 95 security vendors on VirusTotal, indicating a moderate but growing detection rate. The page title, 'Suspected Phishing | Cloudflare,' further corroborates its malicious intent, as this is a default warning often bypassed or ignored by unsuspecting users. No historical registration data is publicly available, suggesting the domain was recently deployed specifically for this campaign. Users who have visited trazor-io-in-com.pages.dev or interacted with its content are at high risk of asset compromise. Immediate actions should include revoking any smart contract approvals granted to unknown or suspicious addresses using tools such as blockchain explorers or wallet-specific revocation services. Affected individuals should also transfer remaining assets to a new, secure wallet and monitor their transaction history for unauthorized activity. If wallet credentials or seed phrases were entered, the compromised wallet should be considered permanently exposed, and all associated funds moved to a new wallet. Security teams are advised to block the domain and its resolving IP address at the network level to prevent further exposure within organizational environments.