web-trezars-brige[.]pages[.]dev

PhishDestroy identifies web-trezars-brige.pages.dev as an active crypto drainer phishing domain currently under investigation for generic phishing activities. The domain leverages Cloudflare Pages to host a fraudulent interface impersonating legitimate services, specifically designed to deceive users into connecting cryptocurrency wallets and authorizing unauthorized transactions. While the exact drainer kit remains unconfirmed, the site’s structure and behavior align with known wallet-draining operations observed in similar campaigns.

This domain resolves to IP 188.114.96.3, registered through Cloudflare, Inc., and secured with a Google Trust Services SSL certificate. VirusTotal reports 0 detections out of 95 engines as of the latest scan, indicating it remains undetected by traditional antivirus solutions. The site was created recently and is not yet flagged by Google Safe Browsing (GSB) or listed on major threat intelligence blocklists, leaving it in an early stage of exploitation where victims may be more vulnerable.

The domain is currently active and poses an imminent risk to users interacting with it, particularly those involved in cryptocurrency transactions. Immediate actions include blocking the domain at the network perimeter, updating firewall rules to prevent outbound connections to 188.114.96.3, and distributing threat intelligence to endpoints. While the current risk is elevated due to low detection rates, ongoing monitoring suggests the threat actor may expand operations or pivot infrastructure. Users are advised to avoid accessing the domain, report it to their security teams, and verify any unsolicited links through trusted channels before taking action.