wltraby-iid7[.]rough-resonance-df2a[.]workers[.]dev

The domain wltraby-iid7.rough-resonance-df2a.workers.dev was registered on 21 February 2026 and is hosted behind Cloudflare’s edge network (AS13335). DNS resolution points to the IP address 188.114.96.3, which is located in the United States and belongs to Cloudflare, Inc. An HTTPS service is presented using a Google Trust Services / WE1 certificate, and the server advertises HSTS and HTTP/3, confirming modern security headers and protocol support. When accessed, the site returns HTTP 403 and the page title is "Suspected phishing site | Cloudflare," indicating that the content has been flagged by Cloudflare’s protective mechanisms. The intelligence tags the site as a credential phishing operation, consistent with the observed page title and the generic classification of the threat.

VirusTotal scans have recorded detections by three of ninety‑five security vendors, reinforcing the malicious assessment. The domain appears on three external blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, while Gridinsoft assigns a trust score of zero out of one hundred, reflecting the consensus of hostile intent. The registrar information shows the domain was created through Cloudflare, Inc., which does not provide additional attribution beyond the hosting provider.

Current monitoring indicates the host has been taken offline, but the infrastructure footprints – the IP address, Cloudflare edge, and the SSL certificate chain – remain reusable by the threat actor. Defenders should continue to block the domain and the associated IP at network perimeters, update threat‑intelligence feeds with the observed indicators, and monitor for re‑registration attempts or reuse of the 188.114.96.3 address in other malicious contexts. Continuous scanning of the IP range and Cloudflare‑hosted assets is advised to detect potential resurgence of the phishing campaign.