lej-er-live-desktop-en[.]pages[.]dev

PhishDestroy identifies lej-er-live-desktop-en.pages.dev as an active crypto drainer phishing domain currently under investigation by threat intelligence teams. The landing page impersonates a legitimate service to trick users into connecting their cryptocurrency wallets, enabling unauthorized asset transfers. Based on telemetry, this domain is part of a campaign targeting desktop users through deceptive page structures and social engineering prompts.

This domain was flagged with a risk level of under_investigation despite zero detections on VirusTotal at the time of analysis (7/95 engines). It resolves to IP address 188.114.96.3 and is served through Cloudflare’s infrastructure, leveraging Google Trust Services for an SSL certificate to appear legitimate. While no blocklist inclusion or creation date is publicly documented, the combination of Cloudflare hosting, Google-issued SSL, and the pages.dev subdomain pattern suggests a recent deployment aimed at evading detection. The absence of detections indicates the campaign may be in early stages or using novel evasion techniques.

Users should refrain from connecting any cryptocurrency wallet or entering sensitive information on this domain. Enable wallet-level transaction alerts and review connected apps regularly. Block the IP 188.114.96.3 at the network level if feasible. Report this domain to PhishDestroy using the unique seed ddc61c for ongoing monitoring and community protection. Avoid clicking links in unsolicited messages referencing this domain.