desktop--en-live[.]pages[.]dev

A recently identified phishing domain, desktop--en-live.pages.dev, is under active analysis for its involvement in fake live streaming phishing campaigns. This domain leverages the legitimate Cloudflare Pages service to host a counterfeit streaming interface, likely mimicking popular platforms to deceive users into entering credentials or payment details. The threat actor behind this infrastructure appears to be utilizing a standard phishing drainer kit tailored to capture streaming service authentication tokens and financial data. Based on seed 83bf27, this campaign is designed to rapidly exploit user trust in recognizable service branding, making it a critical point of investigation for SOC teams monitoring credential harvesting activities.

PhishDestroy's forensic analysis reveals several key technical indicators associated with desktop--en-live.pages.dev. The domain is registered through Cloudflare, Inc., and currently resolves to IP address 188.114.96.3. The SSL certificate in use is issued by Google Trust Services, which may provide an additional layer of perceived legitimacy to potential victims. VirusTotal analysis shows 11/95 detections at the time of assessment, indicating that traditional signature-based defenses have yet to flag this threat. Further, the domain remains unlisted on Google Safe Browsing (GSB) and has not been blacklisted by major threat intelligence platforms, suggesting a relatively new or undetected campaign. The infrastructure's reliance on Cloudflare Pages and a Google-issued SSL certificate underscores the sophistication of the threat actor's evasion tactics, which are designed to bypass basic security controls.

As of the latest assessment, this domain is classified as active, with an under investigation risk status. PhishDestroy's response actions include continuous monitoring of the domain's infrastructure and associated IOCs, as well as the dissemination of this advisory to SOC teams for proactive blocking and takedown requests. While the immediate risk to end users remains elevated due to the lack of widespread detection, the potential for credential harvesting and financial fraud is significant. Organizations are advised to implement network-level blocks for the IP address 188.114.96.3 and the domain itself, as well as to enhance user awareness regarding the risks of fake live streaming platforms. Additionally, SOC teams should prioritize monitoring for similar domains leveraging Cloudflare Pages or other legitimate hosting services to host phishing content. The remaining risk hinges on the rapid identification and takedown of this infrastructure, as the threat actor may quickly pivot to alternative domains or services to continue their operations.