ledzaar-live-desktop[.]pages[.]dev

PhishDestroy identifies ledzaar-live-desktop.pages.dev as an active crypto drainer campaign using a spoofed desktop login interface to steal cryptocurrency from unsuspecting users. The domain leverages Cloudflare Pages for hosting, creating a false sense of legitimacy while employing a drainer script designed to siphon funds from connected wallets. While the campaign masquerades as a generic desktop access tool, its primary objective is cryptocurrency theft, aligning with the growing trend of wallet-draining operations targeting DeFi and Web3 users.

This domain was flagged with 0 detections on VirusTotal as of the latest scan, indicating it remains undetected by most antivirus engines despite its malicious intent. Registered through Cloudflare, Inc., the domain resolves to IP 188.114.96.3 and operates with a Google Trust Services SSL certificate, further enhancing its deceptive appearance. The unique seed identifier 6be2f7 was assigned during the initial threat classification phase, and no blocklist entries have been recorded yet. The absence of detections suggests either a newly deployed campaign or one designed to evade traditional signature-based detection methods.

As of the most recent assessment, ledzaar-live-desktop.pages.dev remains active with a risk level classified as under_investigation, though the specific drainer kit and exact campaign scope are still being analyzed. PhishDestroy has flagged this domain and is coordinating with threat intelligence partners to update detection rules and blocklists. Users are strongly advised to avoid interacting with this domain and to verify any suspicious links using PhishDestroy’s database before proceeding. The remaining risk is assessed as high due to the domain’s potential to cause financial harm to cryptocurrency holders, despite its current low detection rate.