trezr-docs-io[.]pages[.]dev

PhishDestroy identifies trezr-docs-io.pages.dev as a crypto wallet drainer impersonating Trezor documentation, leveraging a spoofed page under the guise of 'trezr docs' to deceive users into connecting wallet extensions. The threat actor’s infrastructure is designed to siphon cryptocurrency assets under the pretext of providing legitimate documentation or wallet integration guides. This domain appears to be part of a broader campaign targeting cryptocurrency enthusiasts seeking support or tools, with the malicious domain hosted on a compromised or attacker-controlled Cloudflare Pages instance to evade detection and maintain operational resilience. This domain was flagged as active with a generic phishing payload and is currently under investigation. VirusTotal flags it at 13/95 detections, indicating no AV or sandbox solution has flagged the payload at time of writing. The domain resolves to IP 188.114.97.3, hosted through Cloudflare, Inc., with a SSL certificate issued by Google Trust Services, which may lend an air of legitimacy to unsuspecting users. The domain is a subdomain under pages.dev, a legitimate domain used by Cloudflare Pages for static hosting, which is commonly abused by threat actors to host phishing kits and malicious landing pages. Further investigation is required to determine the exact drainer kit used, but given the context and naming convention, it is likely a pre-built JavaScript-based drainer targeting browser extensions such as MetaMask or WalletConnect integrations. The absence of detections on VirusTotal suggests the payload may be polymorphic or delivered via staged loading to evade signature-based detection. The current status of the domain is active and under active monitoring by PhishDestroy. No known takedown actions have been observed at this time, and the domain remains resolvable with active SSL encryption. Users are advised to avoid interacting with this domain or any linked content, especially if prompted to connect a wallet or input seed phrases. While the immediate risk is classified as 'under investigation', the lack of detection on VirusTotal and the domain's recent creation (not specified but inferred from the Cloudflare Pages setup) suggest a potentially emerging threat. PhishDestroy recommends users verify any domain purporting to offer cryptocurrency documentation or wallet integrations using its public lookup tool before engagement. Remaining risk is assessed as high due to the targeting of cryptocurrency users and the potential for silent asset drainage. Security teams and users are encouraged to report any interactions with this domain to PhishDestroy for further analysis and inclusion in automated blocklists.