start-tezor-eng-io[.]pages[.]dev

PhishDestroy identifies the domain start-tezor-eng-io.pages.dev as an ACTIVE crypto drainer phishing campaign impersonating the Tezos wallet login interface intended to steal cryptocurrency assets. The threat is currently under investigation while analysts confirm the exact drainer payload and wallet address patterns. All users are advised to treat this domain as malicious and avoid interaction.

This domain was flagged by 15 of 95 VirusTotal vendors, registered through Cloudflare, Inc., resolves to IP 172.66.46.210, and uses a Google Trust Services SSL certificate. The Pages.dev subdomain space indicates a Cloudflare Pages deployment, commonly abused for rapid phishing site staging. Trust scores for associated artifacts remain at zero detections across major threat intelligence platforms, reinforcing the need for proactive blocking and verification before any wallet connection.

The campaign remains ACTIVE and is assessed as HIGH RISK due to the direct targeting of Tezos wallet users and the likelihood of cryptocurrency theft upon interaction. Users who have visited this domain should disconnect any connected wallets, revoke any session tokens, and verify their wallet addresses on official Tezos domains only. PhishDestroy recommends blocking the domain start-tezor-eng-io.pages.dev at the network perimeter and DNS level, and running full antivirus scans. If you suspect exposure, scan your device using PhishDestroy and report the incident with the unique seed 71147c for further analysis and takedown support.