account-block-center[.]pages[.]dev

PhishDestroy identifies account-block-center.pages.dev as an active Microsoft 365 credential phishing domain designed to harvest corporate login credentials. The site is currently operational and impersonates Microsoft’s official login portal to deceive users into submitting their email and password combinations. This campaign leverages urgency messaging around account suspension to pressure victims into immediate action, a common tactic in business email compromise (BEC) attacks.

This domain was flagged by 16 of 95 VirusTotal security vendors, indicating a high level of consensus among threat intelligence platforms regarding its malicious nature. It is registered through Cloudflare, Inc., resolves to IP address 188.114.97.3, and carries a Google Trust Services SSL certificate. The domain has been listed on one security blocklist and is hosted on Cloudflare Pages, a legitimate service often abused by threat actors to rapidly deploy phishing infrastructure. Despite using Google’s trusted certificate infrastructure, the domain’s malicious intent is evidenced by its inclusion in multiple threat intelligence feeds.

The domain remains active and poses an elevated risk to individuals and organizations, particularly those using Microsoft 365. Users should avoid interacting with any links or forms on this domain. If credentials were entered, change passwords immediately and enable multi-factor authentication (MFA) on all Microsoft 365 accounts. Report suspicious activity to Microsoft via the Security Intelligence portal. Organizations are advised to block this domain at the network perimeter and educate employees about recognizing credential phishing attempts, especially those involving urgent language or threats of account suspension.