sharepoint-3ni[.]sandhiprakash-bhide-nanusens-com-s-account[.]workers[.]dev

This domain, sharepoint-3ni.sandhiprakash-bhide-nanusens-com-s-account.workers.dev, is actively flagged as a high-risk credential phishing threat impersonating Cloudflare infrastructure. Registered on May 5, 2026, through Cloudflare Workers, the domain resolves to IP 188.114.97.3, geolocated to Canada and associated with Cloudflare, Inc. The HTTP response returns a 500 status with the page title 'Worker threw exception,' indicating either a misconfigured or intentionally obfuscated phishing attempt. As of July 12, 2026, the domain appears on one security blocklist, and 14 of 91 security vendors on VirusTotal detect it as malicious. The SSL certificate is issued by Let's Encrypt, a common trait in both legitimate and malicious domains. Analysis indicates the domain is designed to exploit Cloudflare's brand and Workers platform to lend credibility to credential harvesting. The subdomain structure mimics SharePoint or enterprise account access portals, a tactic frequently observed in targeted phishing campaigns. While the exact content of the phishing page remains unconfirmed due to the current 500 error, the domain's registration and infrastructure align with known patterns of brand impersonation. Defenders should treat this domain as active and high-risk. Immediate actions include blocking the domain and IP at the network perimeter, monitoring for internal access attempts, and alerting users to potential credential phishing risks. Given the domain's use of Cloudflare Workers, traditional takedown mechanisms may be less effective, necessitating proactive detection and response measures. Further investigation into associated accounts or scripts within the Workers platform may reveal additional malicious infrastructure.