dpuqq-anbp-t8kh[.]c-1o2k0n4w[.]workers[.]dev

This domain, dpuqq-anbp-t8kh.c-1o2k0n4w.workers.dev, is flagged as a high-risk generic phishing threat targeting users with a fake Cloudflare login interface. Analysis indicates the domain is designed to harvest credentials by mimicking legitimate authentication portals, though no specific drainer kit has been identified in initial scans. The page title 'Loading...' suggests dynamic content delivery, likely to evade static detection mechanisms. Infrastructure analysis reveals the domain was registered through Cloudflare Workers on May 13, 2026, and currently resolves to IP 172.67.186.183, hosted in Canada under Cloudflare, Inc. The domain is detected by 13 out of 95 security vendors on VirusTotal, appears on one security blocklist, and employs a Let's Encrypt SSL certificate (serial E7) to enhance legitimacy. No Google Safe Browsing (GSB) entries were found at the time of analysis, though this may reflect detection latency. The domain remains active as of the latest verification, with no takedown actions observed. Response recommendations include immediate blocking of the domain and IP at the network perimeter, as well as monitoring for credential reuse attempts from harvested data. Given the use of Cloudflare Workers for hosting, traditional DNS-based takedowns may prove ineffective, necessitating endpoint-level protections. Users should be alerted to verify domain authenticity before entering credentials, particularly for services leveraging Cloudflare infrastructure.