ms-59g[.]pages[.]dev

PhishDestroy identifies ms-59g.pages.dev as an active Microsoft-themed phishing domain under active investigation. The page mimics a Microsoft login portal to harvest corporate or personal credentials, posing a high risk of account takeover and identity theft. This domain is currently not flagged by most security engines, which increases the danger to end users who may assume it is safe.

This domain was flagged by PhishDestroy’s behavioral analysis engine on seed cde319. It resolves to IP 188.114.97.3, is registered through Cloudflare, Inc., and uses a Google Trust Services SSL certificate. As of the last scan, VirusTotal reported 0 detections out of 95 engines, indicating it remains under the radar of most antivirus platforms. The domain follows Cloudflare Pages’ naming convention (pages.dev), which is often abused to host short-lived phishing kits designed to evade traditional blocklists.

Users should treat any unsolicited login prompts linked to ms-59g.pages.dev as malicious. Never enter credentials on this domain. Report it via your email provider’s phishing button or to Google Safe Browsing (https://safebrowsing.google.com/report_phish/). Block the IP 188.114.97.3 at the network perimeter if possible. Stay vigilant for similar domains using Cloudflare Pages to host fake login forms, especially those mimicking Microsoft, Google, or financial institutions.