nexroute-website[.]pages[.]dev

The domain nexroute-website.pages.dev was registered on March 27, 2026 and is hosted on Cloudflare Pages, resolving to the IP address 172.66.46.212, which is geolocated to Canada and owned by Cloudflare, Inc. The site serves over HTTPS with a valid Let’s Encrypt certificate (E8) and returns HTTP 200 for requests. The page title observed is "Nexroute — High-Performance DEX Routing API," and the intelligence profile classifies the activity as a crypto‑drainer phishing operation. The domain has a Gridinsoft trust score of 0/100, appears on one security blocklist, and is blocked by PhishDestroy. VirusTotal analysis shows three of ninety‑four security vendors flag the domain. Evidence indicates the site is actively being used for malicious purposes, but the exact content and user‑interaction mechanisms have not been examined beyond the title. Defenders should add the domain and its resolving IP to deny‑list rules, enforce URL filtering for Cloudflare‑hosted subdomains, and monitor for any outbound connections to the address. Continuous re‑scanning is advised to detect any changes in the payload or additional detections from threat‑intel feeds.