get-trzur-x-suite[.]pages[.]dev

PhishDestroy identifies get-trzur-x-suite.pages.dev as an active crypto drainer scam with an elevated risk level. This domain is currently operational and distributing malicious payloads designed to siphon cryptocurrency assets from unsuspecting users. The threat involves the unauthorized transfer of digital assets via deceptive smart contract interactions or wallet-draining scripts embedded in the fraudulent interface.

This domain was flagged by 1 of 95 VirusTotal vendors, registered through Cloudflare, Inc., and resolves to IP 172.66.47.105. The SSL certificate is issued by Google Trust Services, indicating a false sense of legitimacy. While the exact creation date is unverified, the domain exhibits recent malicious behavior consistent with crypto drainer campaigns. Current blocklist counts remain low but are expected to rise as additional threat intelligence emerges. The domain’s infrastructure aligns with known patterns of short-lived, malicious Cloudflare Pages deployments used to evade detection.

The domain remains active and poses an immediate threat to cryptocurrency users. PhishDestroy recommends blocking 172.66.47.105 at the network perimeter and blacklisting the domain across all security controls. Users should avoid any interaction with this site and verify all cryptocurrency-related URLs through official sources. Organizations are advised to monitor for outbound connections to this IP and inspect DNS queries for similar domains. Immediate remediation includes updating threat intelligence feeds and conducting endpoint scans for wallet-draining malware.