live-desktop-legdrr[.]pages[.]dev

PhishDestroy identifies live-desktop-legdrr.pages.dev as an active generic phishing domain impersonating Remote Desktop services for credential harvesting. The domain leverages Cloudflare Pages to host a convincing fake login portal designed to trick users into submitting enterprise credentials under the guise of remote access authentication. No branded kit or known drainer script signatures were detected in initial sandboxing; instead, the lure relies on the generic pretext of "remote desktop session continuation" to lower user suspicion. This domain was flagged by 2 out of 95 security vendors on VirusTotal and resolves to IP 188.114.97.3 via Cloudflare proxy. It is registered through Cloudflare, Inc., utilizes a Google Trust Services SSL certificate for HTTPS legitimacy, and shows no immediate presence on Google Safe Browsing lists. The SSL certificate expires in approximately 90 days and was issued on an unspecified date prior to discovery. The campaign remains active as of current analysis with elevated risk to enterprise users expecting legitimate remote access workflows. Immediate actions include blacklisting the domain and IP on corporate DNS, email, and firewall layers; disabling auto-redirects to external domains in remote access portals; and user awareness training to recognize generic "remote desktop" lures. While the infrastructure is ephemeral due to Cloudflare Pages deployment, the threat vector persists through rapid domain cycling. Users are advised to verify URLs via internal SSO or VPN portals and report any unsolicited remote desktop prompts to IT security teams.