leatherbtc-desktop[.]io

This domain, leatherbtc-desktop.io, presents a confirmed brand impersonation threat targeting cryptocurrency users by mimicking a legitimate Bitcoin desktop wallet interface. The site displays the page title 'Leather Desktop Wallet — Bitcoin's Most Advanced Desktop Wallet,' falsely associating itself with established Bitcoin infrastructure to deceive users into downloading malicious software or disclosing sensitive credentials. Such impersonation tactics are commonly employed to facilitate crypto drainer attacks, where victims unknowingly authorize transactions that siphon funds from their wallets to attacker-controlled addresses. Analysis indicates the domain was registered on June 16, 2026, through Squarespace Domains LLC, a registrar frequently abused for malicious infrastructure. The domain resolves to the IP address 91.92.241.250 and is currently flagged by 3 out of 95 security vendors on VirusTotal, with additional detections across three independent security blocklists. Threat intelligence platforms report the domain in two AlienVault OTX pulses, further corroborating its malicious classification. The site has been proactively blocked by multiple security mechanisms, including browser extensions and network-level filters. Users who visited leatherbtc-desktop.io or interacted with its content should immediately cease all engagement and revoke any wallet permissions granted during the session. It is recommended to conduct a full security audit of any devices used to access the domain, including scanning for malware and reviewing installed applications for unauthorized software. Cryptocurrency holders should verify wallet addresses and transaction histories for unauthorized activity, and consider migrating funds to a new wallet if compromise is suspected. No legitimate Bitcoin wallet software would distribute itself through a newly registered domain with this pattern of detection.