cloud-start--trezure[.]pages[.]dev

PhishDestroy identifies cloud-start--trezure.pages.dev as a confirmed crypto wallet drainer site currently active on Cloudflare Pages. The threat vector is a generic phishing page designed to deceive users into connecting a cryptocurrency wallet under false pretenses, enabling unauthorized asset transfers to attacker-controlled addresses. This domain does not impersonate a named brand but instead uses a generic lure likely distributed via social media or messaging platforms targeting crypto users seeking rewards, giveaways, or early access to tools.

This domain was flagged by 2 out of 95 VirusTotal security vendors indicating elevated risk with limited but concerning detection coverage. It is registered through Cloudflare, Inc., resolving to IP address 172.66.47.161, and secured with a Google Trust Services SSL certificate. The domain uses Cloudflare Pages as a hosting platform, a common tactic to rapidly deploy and rotate phishing infrastructure while leveraging Cloudflare’s reputation to evade traditional network-level blocking. While the exact creation date is not publicly disclosed, the domain’s active status and low VT score suggest recent deployment and ongoing operations.

As of current analysis, the domain remains active and accessible, carrying an elevated risk profile due to its use of a reputable hosting and CDN provider. PhishDestroy has flagged this domain under the unique seed identifier 1da517 and continues to monitor its behavior for changes in payload or infrastructure. Users are strongly advised to avoid interaction and verify any link through PhishDestroy’s database before entering credentials or connecting wallets. Remaining risk is moderate given the low detection rate and reliance on dynamic infrastructure, which can quickly shift to avoid countermeasures. Immediate blocking and user awareness remain critical to prevent financial loss.