trzor-suiteo[.]pages[.]dev

PhishDestroy identifies trzor-suiteo.pages.dev as an active cryptocurrency wallet drainer kit impersonating a legitimate wallet service. The domain is currently weaponized to intercept inbound transfers and syphon funds into attacker-controlled addresses. Blockchain fraud teams have confirmed the drainer script matches previously documented BitPay-address spoofing campaigns, indicating reuse of an established malware family. No legitimate brand or service is hosted—this is a pure phishing scaffold designed exclusively for fund theft.

Technical indicators confirm rapid deployment with minimal footprint: VirusTotal shows 8/95 detections at time of analysis, rotating on a fresh Cloudflare Pages tenant. The hostname resolves to 172.66.47.164 via Cloudflare’s Anycast network and is served over an HTTPS certificate issued by Google Trust Services, short-circuiting traditional certificate-based blocking. Registrar metadata indicates creation through Cloudflare, Inc. within the last 48 hours, placing the domain outside established blocklists. Despite SSL hygiene, Safe Browsing (GSB) has not yet flagged the page and aggregate blocklist counts remain at zero.

The campaign is currently active with no takedown or mitigation in place; the unique seed 7ddb2a places this sample in a monitored cluster undergoing forensic triage. Users should avoid opening the link or interacting with any prompts requesting seed phrases or wallet credentials. Blocking rules remain advisory until automated signatures propagate; the remaining risk is evaluated as high due to the live drainer endpoint and zero detections at this snapshot. Immediate action includes network-level blocking of 172.66.47.164, disabling Cloudflare Pages for the tenant, and manual wallet-address verification before transferring funds.