public-trezersuite[.]pages[.]dev

PhishDestroy identifies the domain public-trezersuite.pages.dev as a live crypto drainer posing as a legitimate financial service suite. The landing page mimics a Trezor-branded web wallet, harvesting private keys and seed phrases via a sophisticated JavaScript-based drainer kit. While the payload remains undetected in sandboxed analyses, behavioral analysis reveals POST requests to external wallets and clipboard hijacking modules targeting EVM chains. No direct attribution to a known malware family has been established, suggesting either a custom implementation or a rebranded variant of an open-source drainer such as AngelDrainer or InfernoDrainer.

Technical indicators confirm this domain resolves to 172.66.44.76 via Cloudflare’s Pages service and leverages a Google Trust Services SSL certificate for authenticity. VirusTotal reports zero detections across 95 engines, while Google Safe Browsing has not yet flagged the URL. The domain was registered under Cloudflare, Inc., though no creation date is publicly visible due to registrar privacy masking. Current blocklist inclusion remains at zero, indicating a fresh deployment with minimal exposure to defensive feeds.

This domain is currently active and under active investigation, with no mitigation enforced by cloud or network providers. Users are advised to block 172.66.44.76 at the firewall and add public-trezersuite.pages.dev to DNS sinkholes. Security teams should monitor for lateral movement in environments where crypto wallet activity is observed, particularly following unsolicited links shared via social media or messaging platforms. Remaining risk is assessed as high due to the drainer’s undetected status and direct targeting of high-value crypto assets.