access-form-82h6[.]p-srkphq9l[.]workers[.]dev

On August 05, 2026 the domain access-form-82h6.p-srkphq9l.workers.dev was identified as part of an active generic phishing infrastructure. Registration data shows the domain was provisioned through Cloudflare, Inc., and the authoritative nameserver information could not be retrieved (NS_NOT_FOUND). DNS resolution points to the IP address 104.21.39.208, which is owned by Cloudflare’s edge network and is commonly used for fastly‑distributed content, making attribution to a single operator difficult. The domain appears on two public security blocklists and is explicitly listed by PhishDestroy and OpenPhish, confirming that threat‑intelligence feeds have already flagged it as malicious.

Google Safe Browsing classifies the site as a social engineering threat, indicating that the URL is likely being used to lure victims into credential harvesting or other deceptive actions. VirusTotal analysis reports that four out of ninety‑one scanned security vendors flagged the domain, providing additional independent confirmation of malicious intent. No public SSL/TLS certificate details, HTTP response codes, or page‑title information are presently available, leaving the content of the site unverified.

Given the combination of registrar abuse, edge‑hosted IP, multiple blocklist listings, safe‑browsing warning, and vendor detections, defenders should treat any traffic to this host as high‑risk. Recommended mitigations include adding the domain to internal block lists, configuring web proxies to reject requests to the address, and monitoring outbound connections for anomalous activity targeting the 104.21.39.208 range. Continuous re‑evaluation is advised, as the infrastructure may evolve or additional indicators could emerge.