desktop-as-live[.]pages[.]dev

PhishDestroy identifies desktop-as-live.pages.dev as a generic phishing domain active since seed 7649d6, impersonating desktop live streaming services to harvest user credentials. The domain employs a deceptive naming pattern to mimic legitimate streaming platforms, tricking users into entering sensitive login details under false pretenses. No specific drainer kit or spoofed brand has been confirmed in initial analysis, but the threat type remains classified as generic phishing due to the domain's purpose and structure.

This domain was flagged with a VirusTotal detection score of 12/95, indicating no security vendors currently recognize it as malicious. It was registered through Cloudflare, Inc. and resolves to the IP address 188.114.96.3, which is associated with Cloudflare's infrastructure. The domain utilizes a Google Trust Services SSL certificate, adding a false layer of legitimacy. Creation date and Google Safe Browsing (GSB) status remain unverified at this time, but the lack of detections suggests it is either newly deployed or highly evasive.

The domain remains active with an under investigation risk status, meaning further analysis is required to confirm long-term malicious intent or additional payloads. Users should avoid interacting with desktop-as-live.pages.dev entirely, as it poses a direct credential theft risk. Security teams are advised to monitor this domain for changes in infrastructure, SSL certificates, or associated IP blocks. Remaining risk is moderate due to the domain's active status and low detection rate, warranting continued observation until a definitive threat classification is established.