trzr-walet-lgin[.]pages[.]dev

PhishDestroy identifies trzr-walet-lgin.pages.dev as an active phishing domain impersonating cryptocurrency wallet login portals to harvest credentials. The domain employs a generic phishing tactic, likely targeting users of popular blockchain wallets or exchanges by mimicking official login interfaces. No specific drainer kit or brand spoofing has been confirmed in this campaign, though the naming convention suggests a focus on wallet-related services.

This domain resolves to IP address 188.114.96.3 and was registered through Cloudflare, Inc., leveraging the service’s Workers platform (pages.dev) to host malicious content. The domain utilizes a Google Trust Services SSL certificate, increasing its appearance of legitimacy. According to VirusTotal analysis, only 1 out of 95 security vendors flagged the domain at the time of detection, indicating low initial detection rates despite its malicious nature. The domain’s registration details and infrastructure placement suggest an attempt to evade traditional blocklists and automated detection mechanisms.

As of current intelligence, the threat remains active, with no evidence of takedown or mitigation by hosting providers. Users interacting with this domain risk credential theft, financial loss, or malware infection. Immediate blocking of the domain and IP at the network or endpoint level is recommended. Enhanced monitoring for similar domains using Cloudflare Workers or Google Trust Services certificates is advised. Remaining risk is elevated due to the domain’s active status, low detection rate, and use of reputable infrastructure to host malicious content.