live-en-desktop-eng[.]pages[.]dev

This domain, live-en-desktop-eng.pages.dev, is identified as a credential phishing infrastructure designed to harvest user login credentials through deceptive login interfaces. Analysis indicates no direct association with known brand impersonation or drainer kits, suggesting a generic but targeted phishing campaign. The domain leverages Cloudflare Pages hosting, a common tactic to obscure origin infrastructure and exploit trust in content delivery networks. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.66.47.202 and was registered through Cloudflare, Inc., with a creation date of April 04, 2026. The SSL certificate is issued by Google Trust Services, providing a false sense of security. On VirusTotal, 9 out of 95 security vendors flag the domain as malicious, and it appears on one security blocklist. The domain currently returns a page titled 'Suspected phishing site | Cloudflare,' indicating partial mitigation but not full remediation. The domain is currently offline, likely due to enforcement actions by the hosting provider or security entities. However, residual risk remains due to the domain's recent creation date (April 2026), which may indicate planned future use or rapid redeployment under similar infrastructure. Users and organizations are advised to block the domain at the DNS level and monitor for related subdomains or IP reuse. Security teams should treat any future activity from this infrastructure as high-risk and prioritize endpoint detection for credential theft attempts.