voice-mail-auth-office-com[.]saxeco7653[.]workers[.]dev

The domain voice-mail-auth-office-com.saxeco7653.workers.dev is currently active and classified as a generic phishing campaign. Infrastructure analysis shows the hostname resolves to the IPv4 address 188.114.97.3. The IP belongs to a hosting provider that frequently serves Cloudflare‑protected resources, and the domain was registered through Cloudflare, Inc., indicating use of the provider’s domain privacy and rapid provisioning services. TLS termination is performed by Google Trust Services, which supplies a valid certificate for the host, thereby giving the site a legitimate‑looking HTTPS indicator in browsers. On VirusTotal the domain received detections from 14 of 91 scanning engines, confirming that multiple security products consider the host malicious.

The domain is listed on a single external blocklist and is actively blocked by the PhishDestroy filtering service. Nameserver information could not be retrieved, suggesting that the authoritative records are either hidden behind Cloudflare’s proxy or were not exposed at the time of analysis. No additional intelligence such as page title, Safe Browsing status, or content hashes is available, leaving the exact phishing lure and targeted brand undefined. Defenders should treat any traffic to this host as malicious. Immediate actions include adding the domain and its resolving IP address to outbound deny lists, ensuring that DNS filtering solutions block the domain, and confirming that web proxy rules reject HTTPS connections to the host regardless of certificate validity.

Monitoring for other subdomains that resolve to the same IP, as well as for new domains registered through Cloudflare, can help uncover related infrastructure. Because the certificate is issued by a widely trusted CA, standard TLS inspection may be required to reveal the underlying payload. Organizations should also share the indicator set with threat‑intel platforms to improve community detection.