vlpzh-tcga-w7f4[.]c-o8e5spbn[.]workers[.]dev

This domain, vlpzh-tcga-w7f4.c-o8e5spbn.workers.dev, was registered on 14 May 2026 and is hosted on Cloudflare Workers infrastructure, resolving to IP 188.114.96.3 located in the Cloudflare network. The site presents a valid TLS certificate issued by Let’s Encrypt (E8) and returns HTTP 200 responses with the page title “Loading…”. VirusTotal scans show 11 of 92 security vendors flag the domain, and Gridinsoft assigns a trust score of 0/100, indicating a high likelihood of malicious use. The domain is currently listed on one public blocklist and is actively blocked by PhishDestroy. Intelligence classifies the activity as credential phishing, targeting user credentials, though the specific lure or victim profile has not been observed. The short lifespan, recent creation date, and use of a workers.dev subdomain are consistent with disposable phishing infrastructure. Defenders should add the fully qualified domain name to deny‑list rules across DNS, proxy, and web‑filter solutions, and ensure that TLS inspection policies do not inadvertently allow the encrypted traffic. Continuous monitoring of the associated IP address and any related workers.dev subdomains is recommended, as threat actors may reuse the same edge node for future campaigns. Because the visible page content is limited to the generic “Loading…” title, further automated crawling or sandbox analysis is advised to capture any credential‑collection forms that may be served after initial load. Organizations should also educate users about unexpected login prompts and enforce multi‑factor authentication to mitigate credential compromise risk.