welcm-trezur-star[.]pages[.]dev

PhishDestroy identifies welcm-trezur-star.pages.dev as an active cryptocurrency wallet drainer impersonating the Trezor hardware wallet ecosystem. This deceptive domain employs a sophisticated phishing kit designed to trick users into connecting their wallets, thereby granting unauthorized access to crypto assets. The drainer mimics legitimate Trezor wallet interfaces, leveraging social engineering tactics to deceive victims into entering private keys or seed phrases. This threat is classified as a cryptocurrency wallet drainer phishing campaign, posing a severe risk to users' digital assets due to the irreversible nature of blockchain transactions.

This domain was flagged with a VirusTotal detection ratio of 1/95 security vendors, indicating limited but present recognition of its malicious nature. It is registered through Cloudflare, Inc., resolving to IP address 188.114.96.3, and utilizes a Google Trust Services SSL certificate to appear legitimate. The domain is hosted on Cloudflare Pages, a platform often exploited by threat actors due to its free hosting and anonymity features. While the exact creation date is undisclosed, the domain's active status suggests recent deployment, likely within the past few months. The domain's SSL certificate issuance by a reputable provider highlights the sophistication of the threat actor in evading basic security measures. Currently, this domain remains active and accessible, with no immediate signs of takedown.

As of the latest assessment, welcm-trezur-star.pages.dev continues to operate with an elevated risk level, as evidenced by its ongoing activity and low detection rate. Users are strongly advised to avoid accessing this domain and to verify the authenticity of any Trezor-related communications through official channels. The domain's use of Cloudflare's infrastructure complicates direct blocking efforts, as Cloudflare typically requires formal abuse reports to investigate and take down malicious content. Remaining risk is considered high, particularly for cryptocurrency users who may inadvertently disclose sensitive wallet information. Immediate action includes reporting the domain to Cloudflare's abuse team and updating browser-based blocklists to prevent further victimization. Additional safety measures involve educating users about the risks of entering seed phrases or private keys on unverified websites and promoting the use of hardware wallets for secure asset storage.