workboats[.]hxcw-bluefin[.]com

This domain, workboats.hxcw-bluefin.com, is flagged as an active phishing threat targeting credentials under the guise of a 'Connected Worker' platform. Analysis indicates the domain was registered on September 8, 2025, through Wild West Domains, LLC, and currently resolves to the IP address 198.18.3.29. Security vendors have detected malicious activity, with 12 out of 95 engines on VirusTotal identifying the domain as harmful. Additionally, the domain appears on two security blocklists and is actively blocked by at least two threat intelligence feeds, reinforcing its classification as a high-risk phishing site. Infrastructure analysis reveals the use of HSTS and Google Analytics, which may suggest an attempt to appear legitimate or track victim interactions. The SSL certificate is issued by DigiCert Inc, a common practice among phishing domains to avoid immediate browser warnings. However, the presence of these technologies does not mitigate the threat, as they are frequently exploited to lend credibility to malicious sites. The domain's registration age, combined with its active blocking status, suggests it is part of an ongoing campaign rather than a newly deployed or abandoned operation. The exact content and targeting of the phishing site remain unconfirmed, though the page title 'Connected Worker' implies a focus on industrial, maritime, or enterprise environments where such terminology is commonly used. Defenders should treat this domain as a high-risk credential harvesting site and prioritize blocking it at the network level. Monitoring for connections to the IP address 198.18.3.29 may also help identify compromised endpoints or further malicious activity associated with this infrastructure. Given its active status and detection by multiple security sources, this domain should be considered hostile until further analysis confirms otherwise.