vh2d-5gym-fzwk[.]mqpor-metroquip-us-s-account[.]workers[.]dev

The domain vh2d-5gym-fzwk.mqpor-metroquip-us-s-account.workers.dev is actively involved in credential phishing activities. As of the latest analysis, this domain remains active and operational. The domain's title, 'Worker threw exception', suggests it may be leveraging Cloudflare Workers infrastructure to carry out its malicious activities, although a brand impersonation angle is not explicitly evident. The ongoing risk to users is classified as high due to the active status and technical evidence collected.

According to available data, the domain was created on April 29, 2026, and is registered through Cloudflare Workers. The domain resolves to IP address 188.114.96.3, located in Canada under Cloudflare, Inc. security infrastructure. Current threat intelligence indicates that 17 out of 95 security vendors on VirusTotal have flagged this domain as a threat, suggesting a significant level of detection and concern within the cybersecurity community. Moreover, the domain has been blocked by at least one security provider, PhishDestroy, and appears on one security blocklist. The domain is secured with a Let's Encrypt SSL certificate, which may lend a false sense of security to unsuspecting users.

Given the high-risk level and active status of this domain, it is recommended that organizations implement stringent access controls to prevent potential data breaches. Network administrators should block the IP 188.114.96.3 and monitor for any communications with this domain. Additionally, users should be educated on recognizing phishing attempts, particularly those that may imitate legitimate services using Cloudflare Workers. Regular updates to security tools and threat intelligence feeds are advised to maintain awareness of evolving threats associated with this domain.