7wk0-c0co-0t2l[.]dturcotte-predictms-com-s-account[.]workers[.]dev

This domain, 7wk0-c0co-0t2l.dturcotte-predictms-com-s-account.workers.dev, is currently flagged as an active credential phishing threat. Analysis indicates the page is designed to harvest login credentials through deceptive authentication prompts, though no specific brand impersonation has been confirmed at this time. The domain remains operational and continues to resolve to its hosting infrastructure. Infrastructure analysis reveals the domain resolves to IP address 104.21.21.47, hosted on Cloudflare's network (AS13335). It is registered through Cloudflare, Inc. and secured with a Let's Encrypt SSL certificate (serial number E8). The domain appears on one security blocklist and has been flagged by 7 of 95 security vendors on VirusTotal. No historical registration data is available due to the workers.dev subdomain structure, which obscures traditional WHOIS records. Current status indicates the domain remains active and accessible. Organizations are advised to implement immediate network-level blocking of the domain and associated IP address 104.21.21.47. Endpoint protection should be updated to detect and prevent access to this credential phishing resource. Security teams should monitor for any successful credential submissions originating from this domain and initiate password reset procedures for potentially compromised accounts. The use of Cloudflare's infrastructure suggests the threat actor may leverage additional workers.dev subdomains for future campaigns.