do-trzuriostrt-auth[.]pages[.]dev

Domain do-trzuriostrt-auth.pages.dev has been identified as a phishing endpoint hosting a crypto drainer kit designed to steal cryptocurrency wallet credentials and initiate unauthorized transfers. The threat type is classified as generic_phishing with an elevated risk level and an active status as of seed a12657. Security telemetry indicates this domain mimics legitimate authentication pages to deceive users into surrendering private keys or connecting compromised wallets to drainer scripts. PhishDestroy’s forensic analysis reveals exact technical indicators: the domain resolves to IP 172.66.47.162, is registered through Cloudflare, Inc., and operates under a Google Trust Services SSL certificate. VirusTotal analysis shows 9 out of 95 security vendors flag this domain as malicious. The domain is currently unblocked by Google Safe Browsing (GSB status unknown) and has not been widely listed on major blocklists, indicating a recently deployed or evolving campaign. This domain remains active and poses a persistent threat to cryptocurrency users. Immediate response includes blocking the domain at the network and endpoint levels and updating firewall rules to reject traffic to 172.66.47.162. Users are advised to verify any suspicious authentication or wallet-connect prompts using PhishDestroy’s threat intelligence database to prevent fund loss. Although Cloudflare’s infrastructure is leveraged, the malicious payload remains undetected by some security vendors, maintaining an elevated risk profile until widespread mitigation occurs.