sso-lezrr-desk-io[.]pages[.]dev

PhishDestroy identifies the domain sso-lezrr-desk-io.pages.dev as hosting an active crypto drainer phishing campaign, currently in operation. This threat mimics legitimate authentication portals to deceive users into connecting crypto wallets or submitting credentials, which are then drained by attackers. The infrastructure is designed to exploit trust in cloud-hosted services, specifically leveraging Cloudflare Pages to host malicious content under a plausible domain structure.

This domain was flagged by 13 of 95 VirusTotal security vendors, indicating significant malicious activity. Registered through Cloudflare, Inc., the domain resolves to IP address 188.114.97.3. It holds a Google Trust Services SSL certificate, despite its malicious nature. Google Safe Browsing has classified this domain under the SOCIAL_ENGINEERING category, further confirming its deceptive intent. The domain was created recently and is actively being used to target users in phishing operations.

The current status of sso-lezrr-desk-io.pages.dev remains active, posing a high risk to users who may interact with it. PhishDestroy strongly recommends avoiding any interaction with this domain, including clicking links or entering credentials. Users should verify the legitimacy of any unexpected authentication requests or wallet connection prompts by cross-referencing official sources. Employ multi-factor authentication (MFA) and hardware wallets where possible to mitigate risks. Block this domain and IP at the network level to prevent further exposure. Report any encounters with this domain to PhishDestroy for further analysis and community protection.