ibridge-trazor[.]pages[.]dev

PhishDestroy identifies a live crypto credential theft campaign centered on the domain ibridge-trazor.pages.dev. Threat actors are operating an HTTPS site that impersonates a legitimate “ibridge” service to harvest private keys and wallet credentials from unsuspecting users. The page is delivered via Cloudflare Pages, leveraging the provider’s free-tier infrastructure to evade traditional network filters. Intelligence shows the domain resolves to 172.66.47.203 and is secured with a Google Trust Services SSL certificate, which adds a veneer of legitimacy and lowers user suspicion. VirusTotal currently flags 7 out of 95 detection engines, reflecting the domain’s freshness and the absence of broad signature coverage. The domain was registered through Cloudflare, Inc., exploiting the provider’s rapid provisioning to shorten time-to-live in blocklists. At discovery, the page remains under active investigation, with no known takedowns executed yet and no entries in major blocklists such as Google Safe Browsing, PhishTank, or OpenPhish, giving it a broad window of operation. The combination of Cloudflare’s infrastructure, undetected status, and cryptocurrency lures elevates the operational risk to high for traders and DeFi participants. If you visited ibridge-trazor.pages.dev, immediately revoke any wallet connection permissions that may have been granted and transfer remaining funds to a newly generated wallet with a clean seed phrase. Scan local storage and browser profiles for saved seed phrases, private keys, or mnemonic backups; delete any traces linked to the domain. Report the domain to your wallet provider, antivirus vendor, and PhishDestroy seed 3b8e58 to contribute to collective defense.