route-work-fece[.]pages[.]dev

The domain route-work-fece.pages.dev was first registered on September 02, 2020 via Cloudflare Pages, an infrastructure service that provides static site hosting and automatic SSL. Since its creation the domain has been flagged by multiple security platforms: PhishDestroy, MetaMask, and SEAL have listed it as malicious, and it currently appears on three independent blocklists. VirusTotal analysis shows that two of ninety‑one scanning engines have issued a detection, confirming the presence of malicious activity.

The site’s risk rating is elevated and its operational status is marked as active, indicating that threat actors continue to use the domain for phishing campaigns. No additional intelligence such as page title, targeted brand, or specific phishing kit has been disclosed, so the exact content and lure employed by the site remain unknown. Nevertheless, the convergence of Cloudflare‑based hosting, blocklist presence, and multiple vendor detections provides sufficient confidence to treat the domain as a live phishing vector.

Defenders should block any outbound connections to route-work-fece.pages.dev at the network perimeter, add the domain to internal URL filtering lists, and monitor DNS logs for queries to the domain. Incident response teams should also consider scanning recent email traffic for links to this host and quarantine any messages that reference it. Continuous re‑evaluation is advised, as further analysis may reveal additional indicators such as payload URLs, credential harvesting forms, or compromised accounts associated with the domain.