pages-trzare-home[.]pages[.]dev

PhishDestroy identifies pages-trzare-home.pages.dev as an active Trezor Suite impersonation phishing site luring visitors into installing a drainer kit designed to siphon cryptocurrency holdings. The page masquerades as the legitimate Trezor Suite crypto wallet management platform, exploiting brand recognition to trick users into connecting wallets and authorizing fraudulent transactions. The site’s social engineering payload is delivered via a convincing replica of Trezor’s interface, deceiving even security-conscious visitors into divulging seed phrases or approving malicious token approvals. With a Phishing-as-a-Service (PhaaS) infrastructure now widely commoditized, this operation likely monetizes stolen assets through automated drainer scripts interacting with users’ on-chain funds.

This domain resolves to 188.114.97.3 and is served through Cloudflare, Inc., leveraging Google Trust Services SSL for HTTPS encryption. VirusTotal currently reports 5/95 detections, indicating evasion of common antivirus engines. The domain was registered via Cloudflare Registrar and resolves to a Cloudflare IP address assigned to hosting infrastructure known for abuse. According to Public Suffix List and WHOIS data, the Cloudflare Pages domain was created recently and is hosted on a shared platform commonly abused by phishing campaigns. The domain has not been flagged by Google Safe Browsing (GSB) as of the latest scan, and no major blocklists have flagged it yet, likely due to its recent deployment and use of Cloudflare’s obfuscation layers.

The domain remains active and fully operational, serving phishing content targeting cryptocurrency users. PhishDestroy assesses the immediate risk as HIGH due to the combination of brand impersonation, active hosting, and cryptographic drainer integration. While technical detection remains low (5/95), behavioral and heuristic systems may identify the site as malicious. Users are urged to avoid accessing this domain, verify all wallet URLs manually, and report the site to browser vendors, domain registrars, and threat intelligence platforms. This domain exemplifies the growing sophistication of cryptocurrency phishing campaigns, where trusted brands are weaponized in real-time to extract digital assets. Remaining risk includes ongoing drainer operations, potential data exfiltration, and lateral compromise of connected wallets. Immediate URL blocking and network-level filtering are recommended for cryptocurrency platforms and security teams.