suppor-t--live--en[.]pages[.]dev

PhishDestroy identifies suppor-t--live--en.pages.dev as a credential theft domain actively impersonating a well-known technology company's global support portal. The domain leverages Cloudflare Pages hosting (188.114.96.3) to deliver fake login forms designed to harvest user credentials. Security analysis reveals this infrastructure hosts a sophisticated mimicry of a legitimate support interface, specifically targeting users seeking assistance with Microsoft services. The threat actor uses a visually convincing replica (including SSL certificate from Google Trust Services) to bypass basic security checks, increasing the likelihood of successful credential capture from unsuspecting victims seeking technical support. This domain was flagged by 1 out of 95 security vendors on VirusTotal, indicating limited but confirmed malicious activity. Cloudflare Pages registration obscures the true malicious nature while providing reliable infrastructure for attackers. The domain presents an immediate risk to users who may input their corporate or personal credentials while seeking technical assistance. Given the 1/95 detection ratio, most traditional security tools fail to identify this threat, increasing the danger of successful compromise. If you visited suppor-t--live--en.pages.dev and entered any login credentials, immediately change those passwords and enable multi-factor authentication on all affected accounts. Scan your device for malware using reputable antivirus software, particularly if you downloaded any files or entered payment information. Report the domain to your security team or through PhishDestroy's reporting system, and consider enabling additional monitoring for suspicious account activity. Never use this domain for any legitimate support purposes as it constitutes a confirmed credential theft operation.