source-desktop-faq[.]pages[.]dev

PhishDestroy identifies source-desktop-faq.pages.dev as an active crypto drainer operating under the guise of a legitimate FAQ support page. This domain exhibits classic red flags associated with cryptocurrency theft, where unsuspecting users are lured into connecting their wallets under false pretenses. The malicious infrastructure is designed to exfiltrate funds through deceptive transaction requests, making it a high-risk threat to cryptocurrency users who may mistake it for an official help desk portal.

Technical analysis of this domain reveals concerning indicators of compromise. VirusTotal currently flags the domain with 0 detections out of 95 antivirus engines, indicating it has yet to be widely recognized by security vendors. Registered through Cloudflare, Inc., the domain leverages Cloudflare Pages for hosting, adding a layer of obfuscation commonly used by threat actors to evade detection. The SSL certificate, issued by Google Trust Services, provides an air of legitimacy, while the underlying IP address (188.114.96.3) is associated with known malicious activity. Additionally, this domain has not yet been documented on major threat intelligence blocklists, further emphasizing the need for proactive monitoring and user vigilance.

If you have interacted with source-desktop-faq.pages.dev, particularly by connecting a cryptocurrency wallet or entering sensitive credentials, immediate action is required. Disconnect your wallet from the site immediately and revoke any unauthorized permissions granted during the session. Scan your device for malware using verified security tools and consider transferring remaining funds to a new wallet with a different seed phrase. Report the incident to PhishDestroy to help prevent further exploitation of this domain. Avoid revisiting the site, as it poses an ongoing risk to cryptocurrency assets.