square-art-eb45[.]pcqayteudelrlyi[.]workers[.]dev

Analysis of square-art-eb45.pcqayteudelrlyi.workers.dev shows that the domain is actively serving a generic phishing operation. The domain resolves to the IPv4 address 188.114.96.3, which belongs to Cloudflare's network and indicates the use of Cloudflare's reverse‑proxy services to obscure the true hosting location. Registration information lists Cloudflare, Inc. as the registrar, and no authoritative nameserver records were returned, suggesting reliance on Cloudflare’s default DNS configuration.

Google Safe Browsing has flagged the site for social engineering, and two independent phishing blocklists—PhishDestroy and OpenPhish—have listed the domain as malicious. VirusTotal scans report that ten of ninety‑one scanned security vendors flagged the domain, reinforcing the presence of malicious content. No further metadata such as SSL certificate details, HTTP response codes, or page titles are currently available, limiting the ability to describe the exact payload or credential‑collection mechanism.

The lack of additional infrastructure clues combined with the active status implies that threat actors can still exploit the domain to harvest credentials or deliver additional payloads. Defenders should block traffic to the domain at perimeter firewalls, update DNS filtering policies to include the listed blocklists, and monitor for outbound connections to the associated IP address. Continuous re‑evaluation is recommended, as the underlying phishing kit or target brand may be revealed in future page‑title analyses or sandbox executions.