trizor-co-suite[.]pages[.]dev

PhishDestroy identifies trizor-co-suite.pages.dev as an active generic phishing domain leveraging a deceptive Pages.dev hosting service under Cloudflare to impersonate a crypto wallet suite interface, likely deploying a drainer kit to siphon digital assets. The domain’s recent registration and reliance on Google Trust Services certificates suggest an attempt to appear legitimate while evading initial scrutiny. This threat vector specifically targets users seeking crypto-related tools, exploiting trust in well-known hosting providers to deliver malicious payloads. This domain resolves to IP 172.66.44.178 and remains undetected on VirusTotal with a score of 6/95 detections as of the latest analysis. Registered through Cloudflare, Inc., it employs a Google Trust Services SSL certificate to enhance credibility. While the exact creation date is not specified in the available intelligence, its association with Pages.dev—a legitimate service often abused by threat actors—highlights the need for caution. The absence of detections at this stage indicates it may be newly operational or employing evasion techniques to bypass initial detection mechanisms. The domain is currently flagged with an 'active' status and 'under_investigation' risk level, warranting immediate user awareness and proactive blocking measures. Security teams should add 172.66.44.178 to blocklists and inspect network traffic for connections to this domain or its IP. Given the lack of detections and the drainer’s likely objective—unauthorized asset transfer—the remaining risk is assessed as high, requiring heightened vigilance from both users and defenders to prevent potential financial losses.