trenx-io[.]pages[.]dev

PhishDestroy identifies trenx-io.pages.dev as a recently activated crypto drainer domain flagged under investigation for credential theft. This platform masquerades as a legitimate service while covertly harvesting wallet credentials and draining crypto assets. The threat remains unlisted on major blocklists despite clear malicious intent, indicating either a newly deployed operation or a well-disguised attack vector. Registered through Cloudflare via Google Trust Services SSL, the domain resolves to IP 172.66.44.76 with no detections across 95 VirusTotal scanners as of current analysis. This domain leverages the Pages.dev platform to create a fraudulent interface that impersonates legitimate crypto services or trading tools. Attackers likely distribute links via social media, Discord, or phishing emails promising exclusive features or arbitrage opportunities. Once users connect their wallets or enter credentials, the site silently transmits private keys or session tokens to attacker-controlled servers, enabling unauthorized fund transfers. The absence of VirusTotal detections suggests either a zero-day deployment or evasion tactics such as fast flux DNS or rotating infrastructure, which complicates early detection by traditional security tools. Users who visited trenx-io.pages.dev should immediately revoke any connected wallet permissions using tools such as revoke.cash or wallet provider dashboards. Scan devices for malware using reputable antivirus software and consider transferring remaining assets to a freshly generated wallet with new credentials. Report the domain to your browser’s safe browsing program and share indicators with security communities like PhishDestroy to aid in takedown efforts. Avoid re-engaging with any links or QR codes associated with this domain until independent verification confirms its legitimacy.