271437943103258069784186[.]gpt8437378[.]workers[.]dev

The domain 271437943103258069784186.gpt8437378.workers.dev was created on February 08, 2019 and is currently hosted behind the IP address 188.114.97.3. Infrastructure analysis shows that the domain is registered through Cloudflare Workers, a service frequently abused for rapid deployment of malicious content. The domain is listed on three public security blocklists and has been explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering platforms, indicating that multiple downstream security products have identified it as malicious.

VirusTotal scans report that two out of ninety‑one security vendors flagged the domain, providing additional independent confirmation of its suspicious nature. The risk rating assigned to the domain is elevated and its operational status is active, suggesting that the infrastructure is still being used for phishing campaigns. While the exact phishing lure, targeted brand, or page content has not been disclosed in the available intelligence, the combination of a long‑lived domain, Cloudflare Workers registration, blocklist presence, and vendor detections points to a purposeful phishing operation.

Defenders should continue to block the domain at network perimeters, update endpoint and browser protection suites to include the listed blocklists, and monitor outbound connections to 188.114.97.3 for any anomalous activity. Organizations employing Cloudflare‑based services should verify that legitimate Workers deployments are not being spoofed, and security teams should consider adding the domain to internal deny lists while awaiting further forensic details.