eng-liveldgr-desktop[.]pages[.]dev

PhishDestroy identifies eng-liveldgr-desktop.pages.dev as an ACTIVE credential-harvesting phishing domain operating under the guise of a Microsoft login portal. The threat level remains under investigation but exhibits high-risk characteristics consistent with identity theft campaigns targeting enterprise users.

This domain was flagged after resolving to IP 188.114.96.3 via Cloudflare’s infrastructure, with the SSL certificate issued by Google Trust Services. VirusTotal currently shows 10/95 detections despite active phishing behavior, indicating evasion tactics. The Cloudflare Pages deployment (pages.dev) obscures true hosting details, while the obfuscated subdomain ‘eng-liveldgr-desktop’ suggests a spoofed ‘LiveID’ or Microsoft account lure.

Mitigation requires immediate browser-based blocking of 188.114.96.3 and eng-liveldgr-desktop.pages.dev. Users encountering this domain should avoid entering any credentials and report the URL to Microsoft’s [phishing@microsoft.com](mailto:phishing@microsoft.com). Organizations should deploy network-level protections to quarantine traffic to this IP, as the absence of VirusTotal detections does not guarantee safety. Exercise caution with Cloudflare Pages-hosted forms, verifying sender domains before interaction.