trezzuir-sue[.]pages[.]dev

PhishDestroy identifies trezzuir-sue.pages.dev as an active generic phishing domain distributing a wallet drainer kit designed to steal cryptocurrency assets. The domain impersonates a legitimate crypto wallet service to deceive users into connecting malicious wallets or entering seed phrases. The threat actor behind this campaign employs a drainer script that automatically transfers funds to controlled addresses upon wallet interaction, leveraging social engineering tactics to appear authentic. Domain registration metadata and hosting infrastructure suggest coordinated malicious activity targeting crypto users globally.

Technical analysis reveals trezzuir-sue.pages.dev resolves to IP 188.114.97.3 and is registered through Cloudflare, Inc., utilizing a Google Trust Services SSL certificate for added legitimacy. VirusTotal currently reports 5/95 detections, indicating the domain has not yet been widely flagged by security vendors. The domain was flagged under seed 6ee863 as part of ongoing phishing monitoring, with active status under investigation. Despite the absence of detections, the combination of a Cloudflare-hosted phishing page, HTTPS certificate, and drainer functionality increases operational risk to users.

The domain remains active with medium persistence due to Cloudflare’s protective shielding, complicating direct takedown efforts. Users should block 188.114.97.3 at the network level and avoid all interactions with trezzuir-sue.pages.dev. Security teams are advised to monitor for related domains and update browser blocklists immediately. Remaining risk is moderate due to unflagged status and drainer toolkit effectiveness, requiring proactive user education and real-time threat intelligence updates.