trrrzzrrr---suitee[.]pages[.]dev

PhishDestroy identifies the domain trrrzzrrr---suitee.pages.dev as an active crypto-drainer phishing page under investigation, currently unresolved. This Pages.dev subdomain masquerades as a legitimate suite interface, leveraging a drainer kit designed to siphon cryptocurrency assets upon wallet connection. The campaign shows no affiliation with established brands, suggesting a standalone operation targeting crypto users through deceptive redirection or phishing lures. This domain resolves to 172.66.44.126 and operates under Cloudflare, Inc., hiding registration details behind their privacy services. The SSL certificate issued by Google Trust Services adds a veneer of legitimacy, though VirusTotal reports 6/95 detections as of the latest scan. The subdomain’s recent deployment and lack of historical blocklist presence indicate a fledgling but potentially high-impact threat. While the immediate risk remains under evaluation, users are strongly advised to avoid interaction with this domain. PhishDestroy recommends blocking the IP 172.66.44.126 and the domain at the network perimeter. The absence of detections and Cloudflare’s obfuscation tactics prolong the investigation, but the drainer’s active status warrants heightened vigilance. Monitor updates for IOCs and signature-based detections to mitigate potential exploits.