ldgre-livedesktop[.]pages[.]dev

PhishDestroy identifies a recently activated Microsoft 365 credential harvesting page at ldgre-livedesktop.pages.dev. Hosted on Cloudflare Pages, the domain only recently began resolving to 188.114.96.3 and currently shows zero detections in VirusTotal’s scan of 95 engines. The SSL certificate, issued by Google Trust Services, adds a veneer of legitimacy often leveraged to bypass user suspicion, while the Cloudflare registration obscures the real actor behind the infrastructure.

This domain was flagged specifically for its mimicry of a Microsoft 365 login portal, a common tactic among financially motivated threat actors aiming to harvest corporate credentials. At present, the domain remains undetected across all major security platforms despite its active status. The risk level remains under investigation, but the lack of defensive coverage combined with the domain’s freshness suggests potential for rapid escalation.

If you or your team accessed this domain, any credentials entered should be considered compromised and rotated immediately. Disable affected accounts, enable multi-factor authentication where possible, and scan endpoints for signs of follow-on compromise. Report the domain to your email security provider and block the IP 188.114.96.3 at the firewall. Vigilance is critical—this threat is active and evolving.