form-doc-wyiy[.]p-xqs8hnkj[.]workers[.]dev

The domain form-doc-wyiy.p-xqs8hnkj.workers.dev is currently active and is involved in a high-risk brand impersonation threat. It impersonates Google, a well-known brand, and is designed to deceive users into believing they are interacting with a legitimate Google service.

Analysis indicates that the domain is flagged by 4 of 95 VirusTotal vendors, suggesting a moderate level of detection. The domain is registered through Cloudflare, Inc., and resolves to the IP address 142.251.156.119, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The SSL certificate is issued by Let's Encrypt, and the domain appears on 1 security blocklist. The page title is set to 'Google', further enhancing the deceptive nature of the site.

The current status of the domain is active, and it remains a potential threat. Security teams are advised to monitor this domain closely and consider blocking it at the network level to prevent user access. Additionally, users should be educated to verify the URL and SSL certificate of any site they visit, especially when logging into accounts or providing sensitive information. Organizations should also consider implementing multi-factor authentication to mitigate the risk of credential theft.