share[.]emaley-whaley[.]workers[.]dev

Analysis of share.emaley-whaley.workers.dev shows it is currently active and has been identified as a credential harvesting operation. The domain was created on February 08, 2019 and is hosted behind Cloudflare Workers, indicating the use of a serverless edge platform to serve content. DNS resolution points to the IP address 64.29.17.67, which is not directly associated with any publicly known malicious hosting provider but is reachable through Cloudflare's network.

The domain appears on a single security blocklist and has been specifically blocked by PhishDestroy, confirming that at least one threat intelligence feed has flagged it as malicious. VirusTotal reports that the domain was scanned by 91 vendors, with none reporting a detection, but the absence of detections does not constitute evidence of safety. No publicly available page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts are provided, leaving the content of the site unverified.

Defenders should treat the domain as high‑risk until further analysis clarifies its behavior. Recommended actions include adding the domain to deny lists, monitoring network traffic for connections to 64.29.17.67, and employing URL filtering to block any outbound requests to the subdomain. Continuous re‑evaluation is advised as additional intelligence becomes available.