indrct-0niilne[.]aws-secure-activity[.]workers[.]dev

The domain indrct-0niilne.aws-secure-activity.workers.dev is a credential phishing site designed to harvest login credentials from victims. It does not impersonate a specific brand or use a known drainer kit. As of the latest verification, the site has been taken offline, but it previously posed an elevated risk of credential theft through deceptive login pages.

Technical indicators confirm the domain's malicious nature. The domain, registered through Cloudflare, Inc. on February 21, 2026, was flagged by 15 of 95 VirusTotal security vendors, including ADMINUSLabs, Criminal IP, and alphaMountain.ai. It appears on two security blocklists (PhishDestroy and PhishingDB) and resolves to the IP address 104.21.92.104, hosted by Cloudflare, Inc. in the US. The SSL certificate is issued by Google Trust Services / WE1, and the observed page title was 'Suspected phishing site | Cloudflare'. Technologies detected include HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100 and a Scamadviser trust score of 1/100.

Individuals who may have interacted with indrct-0niilne.aws-secure-activity.workers.dev should immediately change passwords for any accounts accessed during the exposure period. Enable two-factor authentication (2FA) on all critical services to prevent unauthorized access. Monitor accounts for signs of fraud, such as unauthorized transactions or login attempts. Report the domain to relevant authorities, including the Anti-Phishing Working Group (APWG) at reportphishing@apwg.org, and consider submitting the URL to Google Safe Browsing via their reporting tool to aid in broader protection efforts.