suite-web-trzr-io[.]pages[.]dev

PhishDestroy identifies suite-web-trzr-io.pages.dev as an active crypto drainer posing as a legitimate service. This domain leverages Cloudflare Pages to host a deceptive interface designed to trick users into connecting cryptocurrency wallets under false pretenses. Once a victim authorizes a transaction, the drainer silently siphons funds into attacker-controlled addresses. The infrastructure behind this domain resolves to IP 172.66.47.110, which is associated with Cloudflare’s hosting environment—a common tactic to evade detection and prolong operational uptime. This domain remains undetected by traditional security engines, with VirusTotal showing 0 detections out of 95 scans, and no presence on public blocklists. Registered through Cloudflare, Inc., the domain uses a Google Trust Services SSL certificate to reinforce its appearance of legitimacy. While the creation date is not specified, the use of Cloudflare Pages suggests recent deployment, likely within the last few months. The absence of detections highlights the evolving nature of this threat, which avoids known indicators of compromise to remain operational. If you or anyone in your organization has interacted with suite-web-trzr-io.pages.dev, disconnect any connected wallets immediately and revoke unauthorized permissions via blockchain explorers or wallet interfaces. Do not enter any sensitive information or approve transactions—even small test amounts—to this domain. Report the domain to PhishDestroy for further analysis and inclusion in threat intelligence feeds. Monitor blockchain transactions for unauthorized outflows and consider rotating wallet addresses if compromise is confirmed.