# PhishDestroy threat dossier — desktop-en-access.pages.dev ================================================================ Fetched: 2026-04-25 06:31:53 UTC Canonical: https://phishdestroy.io/domain/desktop-en-access.pages.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Ledger ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 6/94 security vendors flagged this domain Flagging vendors: ADMINUSLabs, CyRadar, Fortinet, Kaspersky, LevelBlue, Sophos ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: Cloudflare, Inc. Nameservers: paityn.ns.cloudflare.com, thomas.ns.cloudflare.com Registered: 2026-03-25 Page title: Ledger Live Desktop | Secure Crypto Wallet ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-06-17 Status: INVALID chain Fingerprint: 935ec2e7d54bdc804a6720eda0b7cd50e2f112ad7c330d9eba486d2647cbefef ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-03-25 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-03-25 18:00:01 UTC (by PhishDestroy tracker) Last verified: 2026-04-21 16:08:05 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d2580-8f44-755d-abee-c21428ba51f8/ Wayback Machine: https://web.archive.org/web/*/desktop-en-access.pages.dev crt.sh CT logs: https://crt.sh/?q=%25.desktop-en-access.pages.dev Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=desktop-en-access.pages.dev AlienVault OTX: https://otx.alienvault.com/indicator/domain/desktop-en-access.pages.dev URLhaus: https://urlhaus.abuse.ch/host/desktop-en-access.pages.dev/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-03-25 18:05:18 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies desktop-en-access.pages.dev as an active crypto-drainer phishing page deployed on Cloudflare Pages. The domain was registered minutes ago and currently resolves to 188.114.97.3, hosted behind Google Trust Services SSL. 0 of 95 security engines on VirusTotal flagged the site as malicious at the time of analysis, indicating it remains undetected by most scanners while actively targeting crypto users. This threat works by luring victims to a convincing replica of a legitimate desktop-access portal where a malicious JavaScript wallet drainer silently approves unlimited token transfers once a crypto wallet is connected. The domain uses Cloudflare’s free Pages service to spin up new subdomains rapidly, complicating takedowns and bypassing some IP-based blocklists. The presence of a Google Trust Services certificate adds a cosmetic veneer of legitimacy, increasing the chance that non-technical users will enter credentials or connect wallets. If you visited desktop-en-access.pages.dev, immediately revoke any wallet connections through your wallet’s connected-app or settings page. Do not approve any pending transactions. Clear browser cache and cookies, run a malware scan, and consider rotating wallet addresses. Report the domain to Google Safe Browsing (safebrowsing.google.com/report_phish) and your antivirus vendor using the seed 5e567f for cross-correlation. Disable browser extensions and use a separate, hardware-isolated wallet for future tests to prevent second-stage attacks. [Updates since narrative was generated:] - VirusTotal detections: now 6/94 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 935ec2e7d54bdc804a6720eda0b7cd50e2f112ad7c330d9eba486d2647cbefef ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/desktop-en-access.pages.dev/ JSON API: https://api.destroy.tools/v1/check?domain=desktop-en-access.pages.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io