trzorr-suits[.]pages[.]dev

PhishDestroy identifies trzorr-suits.pages.dev as an active crypto drainer scam hosted on Cloudflare Workers. The domain masquerades as a legitimate wallet interface, tricking users into connecting their crypto wallets to drain funds via malicious transaction signing. This is not a generic phishing attempt but a specialized cryptocurrency theft operation, elevated due to the irreversible nature of crypto transactions and the sophistication of the lure. This domain was flagged on seed 1328d8 and resolves to Cloudflare IP 172.66.45.29. It was registered through Cloudflare, Inc., leveraging Google Trust Services’ SSL certificate for authenticity. VirusTotal currently shows 9/95 detections, indicating it has evaded traditional signature-based detection. The use of Cloudflare Workers (pages.dev) suggests dynamic, serverless hosting designed to bypass static blocklists. As of the latest assessment, this domain remains unlisted on major threat intelligence feeds, highlighting its novelty and the challenge of early detection in the crypto phishing landscape. Mitigation for this threat type requires immediate user caution: never connect your wallet to unverified websites, even if they appear legitimate. Use hardware wallets or trusted interfaces like MetaMask’s browser extension with active phishing protection. Verify URLs manually by cross-referencing official project websites or social media channels. If you’ve interacted with this domain, revoke any connected wallet permissions immediately via tools like revoke.cash and scan your device for malware. Report the domain to PhishDestroy and your wallet provider to aid in takedown efforts. Always enable multi-factor authentication for wallet services and consider using a dedicated browser profile for crypto transactions.