desktopwallet-installer[.]live

Analysis of desktopwallet-installer.live indicates an active crypto‑drainer infrastructure. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare‑owned address 188.114.97.3, ASN 13335 (Cloudflare, Inc.) located in the United States. The site presents a TLS certificate issued by Let’s Encrypt (E7) and serves HTTP/3 traffic behind Cloudflare, with Cloudflare Browser Insights detected. An HTTP 403 response is returned for the default request, and the page title reported by scanners is “Just a moment…”.

Reputation services flag the domain as malicious: three of ninety‑three VirusTotal scanners have raised detections, Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single external blocklist. PhishDestroy has already listed the site as blocked. The observed scam type is a crypto scam, specifically a crypto drainer that likely attempts to steal cryptocurrency wallets or private keys. While the exact payload or phishing pages have not been publicly disclosed, the combination of a low trust score, multiple vendor detections, and active blocklist listings suggests a high‑confidence malicious intent.

Defenders should block DNS resolution to the domain, add the IP address 188.114.97.3 to network deny lists, and monitor outbound traffic for attempts to contact Cloudflare‑served endpoints that match the observed TLS fingerprint. Continuous re‑scanning is advised to capture any evolving payloads, and any discovered credential or wallet exfiltration should be treated as a compromise. The evidence base is limited to registration, hosting, SSL, HTTP status, and vendor detections; further forensic analysis of the site content would be required to confirm the exact theft mechanism.