voice-mail-office-auth-device[.]dporozok[.]workers[.]dev

Analysis of the domain voice-mail-office-auth-device.dporozok.workers.dev shows that it is provisioned through Cloudflare, Inc., which supplies both DNS and CDN services. The domain resolves to the IP address 188.114.96.3, an address known to host multiple malicious sites and frequently observed in phishing infrastructure. Current threat‑intelligence feeds list the domain on one security blocklist and it is actively blocked by the PhishDestroy service. VirusTotal scans indicate that 12 of 91 antivirus and URL‑reputation engines have flagged the domain as malicious, providing additional corroboration of its abusive nature.

Nameserver data is unavailable (NS_NOT_FOUND), limiting visibility into the underlying authoritative DNS configuration. No public page title or SSL certificate details have been published, and the content of the site has not been captured, leaving the specific lure or credential‑capture technique uncertain. Defenders should add the domain to outbound and inbound filtering rules, include the associated IP address 188.114.96.3 in network‑level blocklists, and monitor for any DNS queries to the dporozok.workers.dev suffix. Because the hosting provider is Cloudflare, applying rate‑limiting or challenging traffic at the edge may mitigate automated harvesting attempts.

Continuous re‑scanning on VirusTotal and other sandbox services is recommended to detect any changes in payload or hosting. Organizations that rely on email or voice‑mail authentication workflows should treat any unsolicited requests referencing this domain as hostile and educate users to avoid clicking links or entering credentials. The limited visibility underscores the need for proactive threat‑intel enrichment and rapid response when similar Cloudflare‑hosted subdomains appear.