eng-trezr--hardwere[.]pages[.]dev

PhishDestroy identifies the domain eng-trezr--hardwere.pages.dev as an active crypto drainer impersonating hardware wallet services. The page mimics legitimate crypto asset portals to trick users into connecting wallets and draining funds. No specific drainer kit (e.g., MetaMask or WalletConnect spoofing) has been confirmed in this campaign, but the infrastructure suggests automated fund extraction post-connection. The threat is categorized as a crypto drainer due to the modus operandi and target audience—users managing crypto assets.

EXACT indicators include: VirusTotal detections at 9/95 engines, Cloudflare registration, a Google Trust Services SSL certificate, and a resolving IP of 172.66.44.126. The domain is hosted on Cloudflare Pages, leveraging legitimate infrastructure to evade traditional blocking mechanisms. As of the seed 52c86d analysis, the domain remains unflagged in Google Safe Browsing (GSB) and has no recorded blocklist entries, indicating a newly emerged or stealthily operated threat.

The domain is currently active and under investigation with a risk level classified as under_investigation. Immediate actions include blocking the IP 172.66.44.126 and the domain at DNS and network levels. Users are advised to avoid interacting with eng-trezr--hardwere.pages.dev and report any suspicious wallet connections to their security teams. Remaining risk includes potential expansion via phishing emails or social media impersonation targeting hardware wallet users. Enhanced monitoring for wallet connection prompts and fund drains is recommended.