trzr-io--hrde-guide[.]pages[.]dev

PhishDestroy identifies trzr-io--hrde-guide.pages.dev as a live crypto drainer phishing domain under active forensic review. This subdomain leverages a Pages.dev hosting zone controlled by Cloudflare to masquerade as a transaction guide, likely targeting cryptocurrency users with fake wallet-draining payloads. No specific drainer kit signature has been extracted yet, but the structure and naming (hrde-guide) align with high-velocity crypto-themed phishing campaigns observed since Q2 2024.

Technical indicators confirm this domain resolves to IP 188.114.97.3 via Cloudflare and is served over an SSL certificate issued by Google Trust Services. VirusTotal currently shows 10/95 detections, indicating zero vendor coverage as of the latest scan. The domain was registered through Cloudflare, Inc., and is hosted on Pages.dev infrastructure, which is frequently abused for quick-turn phishing lures. Google Safe Browsing (GSB) status remains unlisted, and public blocklist counts are not yet available, placing this domain in a blind-spot window.

Status of this domain is marked active with risk level under_investigation; no takedown or mitigation has been applied. Users should blocklist this domain immediately and avoid interaction. Security teams are advised to monitor for follow-up domains on the same IP (188.114.97.3) and to scan endpoints for wallet-drainer artifacts. Given the absence of vendor detection and the domain’s live status, the current risk remains high until further evidence is collected and disseminated through threat intel channels.