bridge-trezrr-starts[.]webflow[.]io

PhishDestroy identifies the domain bridge-trezrr-starts.webflow.io as an active crypto drainer phishing site currently engaged in malicious operations. This domain mimics legitimate cryptocurrency interfaces to deceive users into connecting their wallets and approving unauthorized transactions. The threat remains active at the time of this report, with no evidence of takedown or mitigation by the domain owners. This domain has been flagged by 20 of 95 VirusTotal security vendors, indicating significant malicious activity. The domain resolves to IP address 172.64.151.8 and is associated with Google Trust Services for its SSL certificate. The domain is hosted on Webflow and was created recently, though the exact creation date is not publicly disclosed. PhishDestroy's analysis confirms the domain has been blocked by OpenPhish, OISD, and appears on 2 additional security blocklists, reinforcing its elevated risk profile. Given the active status and confirmed malicious behavior, all users are strongly advised to avoid interacting with bridge-trezrr-starts.webflow.io. Cryptocurrency holders should verify URLs through PhishDestroy before entering wallet credentials or approving transactions. Security teams should implement network-level blocks for this domain and its associated IP address to prevent further compromise. Continuous monitoring of this domain is recommended due to its potential for evolving tactics and additional malicious payloads.