lj4y-lxqc-ukfw[.]erik-cintive-com-s-account[.]workers[.]dev

PhishDestroy has identified lj4y-lxqc-ukfw.erik-cintive-com-s-account.workers.dev as a high-risk credential phishing domain. This domain attempts to steal login credentials, likely impersonating an account-related service. No specific brand or drainer kit was identified, but the domain's structure suggests it may target users of platforms like Erik Cintive. The threat is active and poses a significant risk to anyone who encounters it.

Technical indicators paint a clear picture of malicious intent. VirusTotal reports 14 out of 95 security vendors flagging this domain as malicious. It is registered through Cloudflare Workers and resolves to IP address 188.114.96.3. The domain was created on April 23, 2026, and uses a Let's Encrypt SSL certificate (E7). It appears on one security blocklist and is not listed on Google Safe Browsing. The page title displayed is "Worker threw exception," which may indicate the phishing page is temporarily broken but the domain remains active.

As of now, the domain is still active and accessible. PhishDestroy recommends blocking this domain immediately and avoiding any interaction. Users who encounter this domain should report it and verify any account-related requests through official channels. The remaining risk is high, as the domain could become functional at any time to harvest credentials. Stay vigilant.