gateway-run[.]pages[.]dev

This domain, gateway-run.pages.dev, is currently under investigation for hosting a fake CODE COMPILER phishing page designed to deceive users into executing malicious scripts or entering sensitive credentials. The site remains active as of the latest verification using seed identifier 5a1420, with no prior takedown attempts recorded. Analysis indicates that the domain has not been flagged by any of the 95 security vendors on VirusTotal, suggesting it may be newly deployed or evading detection through obfuscation techniques. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.181. The SSL certificate is issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users. The page title, CODE COMPILER, is likely used to impersonate a legitimate development tool or online coding environment, potentially targeting developers, IT professionals, or users involved in software testing. Infrastructure analysis reveals that the domain is part of a content delivery network, which may complicate attribution and takedown efforts. Given the absence of detections on VirusTotal and the use of reputable hosting and certificate providers, the risk of successful compromise remains elevated. Organizations and individuals are advised to block access to the domain at the network level and monitor for any outbound connections to 172.66.44.181. Users should be educated on recognizing phishing attempts involving fake development tools, particularly those hosted on non-standard or newly registered domains. If credentials or sensitive data have been entered on this site, immediate revocation and password resets are recommended.