wallt-trezrr-en[.]pages[.]dev

PhishDestroy identifies wallt-trezrr-en.pages.dev as a live crypto drainer phishing domain that surreptitiously drains cryptocurrency wallets when victims connect or sign transactions. The page masquerades as a legitimate wallet interface or token offer, but transfers funds to attacker-controlled addresses without user consent. Campaigns often spread via social-media spam, Discord DMs, or fake airdrop links, promising high returns to lure inexperienced traders into connecting their wallets. Once connected, the drainer silently approves malicious token contracts that siphon tokens directly from connected wallets, including ERC-20, BEP-20, and Solana SPL assets. Victims typically notice balance drains minutes after interaction, with no option for refunds due to irreversible blockchain transactions. This domain was flagged on 2024-05-15 and is currently active. It resolves to IP 188.114.96.3 via Cloudflare Pages, masking its true origin. The SSL certificate is issued by Google Trust Services, which may lend false legitimacy to unsuspecting users. VirusTotal currently shows 0 security vendors detecting any malicious content as of the latest scan, indicating this campaign remains under the radar. The domain was registered through Cloudflare, Inc., leveraging their free Pages platform to rapidly deploy new phishing pages and evade takedown efforts. Historical intelligence reveals similar drainer campaigns pivoting through Cloudflare Pages endpoints, often lasting less than 48 hours before being replaced with new subdomains. If you visited wallt-trezrr-en.pages.dev or connected your wallet, disconnect immediately using your wallet’s disconnect feature or clear browser data. Transfer remaining assets to a new wallet address and revoke any malicious token approvals via tools like Etherscan’s Revoke.cash or Solscan’s approval manager. Enable multi-factor authentication on exchanges and wallets, and consider using hardware wallets for high-value assets. Report the domain to your wallet provider and relevant authorities such as the FBI IC3 or local cybercrime units. Monitor transaction logs for unauthorized transfers and alert your network administrator if this domain appeared in a business context. Stay vigilant for follow-up phishing attempts targeting recovery phrases or private keys.