trejr-io-sart-era[.]pages[.]dev

PhishDestroy identifies trejr-io-sart-era.pages.dev as an active crypto drainer phishing domain. The site is hosted on Cloudflare Pages and resolves to IP 188.114.96.3, which is associated with malicious infrastructure linked to cryptocurrency theft. This domain uses a Google Trust Services SSL certificate to appear legitimate, but its sole purpose is to deceive users into connecting wallets or entering private keys. The campaign is currently under investigation but remains active, with no detections on VirusTotal (13/95) as of the latest scan. This domain was flagged through automated threat intelligence pipelines and is not yet listed on major blocklists. Registration details are obscured via Cloudflare, Inc., a common tactic to hinder takedown efforts. The domain resolves to IP 188.114.96.3, a known malicious host often used in phishing and crypto drainer campaigns. The Google Trust Services SSL certificate adds a false sense of security, tricking users into believing the site is trustworthy. While no blocklist entries exist yet, the combination of zero detections, active status, and crypto-focused deception warrants immediate caution. Mitigation for this threat requires strict adherence to wallet and credential safety protocols. Users should never connect wallets or enter private keys on unfamiliar domains, especially those hosted on Cloudflare Pages with recent creation dates. Verify suspicious links using PhishDestroy’s real-time scanning tool before interaction. If exposed, revoke any connected wallet permissions immediately via blockchain explorers or wallet settings. Report the domain to PhishDestroy for further analysis and blocklist inclusion. Always cross-check URLs for misspellings or unusual TLDs, as crypto drainers frequently mimic legitimate services.