urlshort-linkmrrwjc0kdzql[.]esu2n5lwqi[.]workers[.]dev

Analysis indicates that the domain urlshort-linkmrrwjc0kdzql.esu2n5lwqi.workers.dev resolves to the IPv4 address 188.114.96.3. The hosting service is provided by Cloudflare, Inc., as shown by the registrar information. The domain lacks publicly resolvable name server records, as the nameserver lookup returned NS_NOT_FOUND, which may hinder traditional DNS‑based verification. On the threat‑intelligence side, the domain is listed on a single security blocklist; the blocklist entry originates from PhishDestroy, confirming that at least one external sinkhole has taken action against it.

VirusTotal has recorded detections from 12 of 91 scanned scanners, reflecting a moderate level of consensus among automated analysis engines that the domain is malicious. The overall risk rating assigned is high, and the campaign status is marked as active as of the report date, July 28, 2026. No additional contextual data such as page title, brand targeting, or specific phishing kit identifiers are available, leaving the exact lure or victim profile undefined.

Defenders should continue to block the domain at network perimeter devices, update DNS filtering policies to include the observed IP address, and monitor for any new resolutions or related sub‑domains that may emerge from the same Cloudflare account. Because the domain is still reachable, any inbound traffic should be logged and inspected for credential‑stealing attempts. Continuous re‑evaluation is advised, given the possibility of further detection counts or blocklist inclusions as the campaign evolves.