ttreezor-suite[.]pages[.]dev

PhishDestroy identifies ttreezor-suite.pages.dev as a generic phishing domain currently under investigation for potential crypto drainer activity. This webpage mimics the legitimate TREEZOR brand, likely targeting cryptocurrency holders via deceptive interfaces that prompt unauthorized fund transfers. No specific drainer kit fingerprint (e.g., MetaMask or WalletConnect) has been confirmed yet through public sandboxing, but the attack vector suggests credential interception or fund siphoning upon interaction.

This domain resolves to IP address 188.114.96.3 and leverages Cloudflare’s registrar infrastructure. VirusTotal shows zero detections (7/95), indicating no current AV consensus despite red flags. It holds a Google Trust Services SSL certificate, and its creation date remains undisclosed as Cloudflare privacy protection is active. The domain fits Cloudflare Pages’ serverless hosting pattern, complicating takedown efforts. It remains unlisted on major blocklists (e.g., Google Safe Browsing, PhishTank) as of latest scans.

As of this report, ttreezor-suite.pages.dev remains active with a status of 'under_investigation'. No takedown has been initiated. Users are advised to avoid interaction and flag the domain via their browser or security tools. While immediate risk appears low due to low VT score, the absence of AV flags cannot guarantee safety—historical drainers have evaded detection for days before signature updates. Continuous monitoring is required until classification solidifies.