dworkez[.]pages[.]dev

This domain, dworkez.pages.dev, is under active investigation for generic phishing activity targeting cloud service credentials. Infrastructure analysis reveals the domain is hosted on Cloudflare's content delivery network, resolving to the IP address 188.114.96.3, with nameservers hassan.ns.cloudflare.com and mary.ns.cloudflare.com. The domain appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, indicating prior detection by multiple threat intelligence sources.

While VirusTotal scans by 91 vendors currently show no detections, this absence does not confirm safety, as phishing domains often evade initial detection or are flagged only after further analysis. The domain's registration through Cloudflare aligns with common phishing tactics leveraging legitimate CDN services to obscure origin and improve uptime. Defenders should treat this domain as high-risk until further analysis confirms its intent.

Recommended actions include blocking the domain at the network perimeter, monitoring for connections to 188.114.96.3, and reviewing logs for credential submission attempts linked to this domain. The exact content and target brand remain unconfirmed, as no page title or specific scam kit details are available in current intelligence. Additional forensic analysis, such as sandbox execution or SSL certificate inspection, may provide further indicators of compromise.