# on-trzer.pages.dev — SUSPICIOUS

> Is on-trzer.pages.dev safe? It hosts a crypto drainer! 0/95 VirusTotal detections — verify with PhishDestroy now for safety.

## Summary
PhishDestroy identifies on-trzer.pages.dev as an active crypto drainer domain currently under investigation. This malicious site disguises itself as a legitimate service but is designed to steal cryptocurrency from unsuspecting users. The domain leverages Cloudflare’s infrastructure and a Google Trust Services SSL certificate to appear credible, while its IP address (172.66.47.126) is linked to suspicious hosting environments. Users should treat this domain as a high-risk threat to their digital assets and personal data.  

This domain was flagged by PhishDestroy with a status of 'active' and a risk level of 'under_investigation'. Intelligence gathered shows it was registered through Cloudflare, Inc., a common tactic for threat actors to obscure ownership. The domain currently resolves to IP 172.66.47.126, a Cloudflare IP address that has been associated with multiple phishing and fraudulent activities. VirusTotal scans reveal 0 detections out of 95 antivirus engines, indicating it remains undetected by many security tools at this time. While blocklist data continues to evolve, PhishDestroy’s proactive monitoring identifies this as a live threat.  

If you have visited on-trzer.pages.dev, your cryptocurrency wallets, browser extensions, and device security may be compromised. Crypto drainers often deploy malicious JavaScript to intercept and redirect transactions, stealing funds without the user’s knowledge. Immediately revoke any permissions granted to this domain, disconnect wallets from websites, and scan your device for malware using reputable security software. Report this domain to PhishDestroy and your wallet provider to help prevent further attacks. Users should also monitor their transaction history for unauthorized activity and consider transferring remaining funds to a secure, offline wallet. Never interact with untrusted sites claiming to offer crypto services without thorough verification.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.126

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/a4475e73-e4bf-476d-8f4d-0e907b481dec
- PhishDestroy: https://phishdestroy.io/domain/on-trzer.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/on-trzer.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/on-trzer.pages.dev/
Last updated: 2026-03-26