loghi-us-trezar[.]pages[.]dev

This domain, loghi-us-trezar.pages.dev, is identified as a cryptocurrency wallet drainer designed to siphon digital assets from victims' wallets. Analysis indicates the site employs social engineering tactics, likely presenting itself as a legitimate wallet interface or recovery portal to trick users into entering sensitive credentials or approving malicious transactions. The threat specifically targets cryptocurrency holders, exploiting their trust in decentralized platforms to facilitate unauthorized transfers of funds to attacker-controlled addresses. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on April 03, 2026, through a privacy-focused registrar, with resolution to the IP address 188.114.96.3, geolocated to a content delivery network node in Canada. Security vendors on VirusTotal flagged the domain at a rate of 19 out of 95 engines, while it appears on one additional security blocklist. The SSL certificate, issued by a major provider, does not mitigate the risk, as the domain's content and behavior remain malicious. The page title explicitly states 'Suspected phishing site,' further corroborating its fraudulent nature. Users who interacted with this domain should immediately revoke any wallet approvals granted during the session, particularly those involving token spending or contract interactions. It is critical to transfer remaining assets to a new, secure wallet address and monitor transaction histories for unauthorized activity. If credentials or private keys were entered, assume full account compromise and cease use of the exposed wallet. Additionally, affected users should report the incident to relevant blockchain security teams and consider filing a report with local cybercrime authorities to aid in tracking the threat actor's infrastructure.