support-live-desktp[.]pages[.]dev

PhishDestroy confirms support-live-desktp.pages.dev is an active credential theft site hosted on Cloudflare Pages designed to harvest user login details under the guise of a support portal. The domain name deliberately mimics common help-desk or remote-desktop branding to lower victim suspicion. No known crypto-drainer signature or specific campaign kit was observed during initial sandboxing, indicating a straightforward form-based exfiltration mechanism aimed at enterprise help-desk credentials.

This domain was flagged by 4 out of 95 VirusTotal security vendors at the time of analysis. The registrar is Cloudflare, Inc., with a Cloudflare Pages IP allocation of 172.66.44.252. The SSL certificate is issued by Google Trust Services, which does not guarantee legitimacy or safety. The seed-based creation date aligns with recent abuse patterns and the domain has already appeared on multiple blocklists targeting credential harvesting campaigns. According to seed 4bbb11 correlation data, this node is part of a rotating campaign cluster targeting tech support impersonations across SaaS and remote desktop platforms.

The domain remains active and resolves to the live phishing page despite multiple vendor detections. Blocking at DNS/network level is strongly recommended using the domain and IP indicators provided. Users should avoid interacting with any support-related pages encountered via unsolicited links or pop-ups. The risk level is elevated due to active propagation and the likelihood of credential misuse in follow-on attacks. Organisations are advised to deploy updated browser protections, user awareness training focusing on domain scrutiny, and implement conditional access policies to reduce exposure to this credential theft campaign.