nhgo-2xnx-cw12[.]jennifer-jencrosslaw-com-s-account[.]workers[.]dev

This domain, nhgo-2xnx-cw12.jennifer-jencrosslaw-com-s-account.workers.dev, is actively flagged as an elevated-risk credential phishing threat. Infrastructure analysis reveals it is hosted on Cloudflare Workers, a serverless platform often exploited for rapid phishing deployment due to its low cost and ephemeral nature. The domain resolves to IP 172.67.137.242, a Cloudflare-operated address commonly shared across multiple Workers instances, limiting attribution but confirming infrastructure reuse. Registered since February 8, 2019, the domain predates recent detection, suggesting either dormant use or persistent abuse of a long-standing resource. As of July 29, 2026, the domain appears on one security blocklist and is specifically blocked by PhishDestroy.

While VirusTotal shows 15 of 91 security vendors flagging the domain, this detection count reflects community consensus rather than definitive proof of malicious activity. No additional context—such as page title, brand impersonation, or phishing kit—is available in the current data, so the exact lure or targeted service remains unconfirmed. The absence of Safe Browsing or OTX records does not indicate safety, as these feeds may lag behind real-time abuse. Defenders should treat this domain as an active credential harvesting endpoint.

Immediate action includes blocking the domain at DNS and proxy layers, monitoring for internal access attempts, and reviewing logs for connections to 172.67.137.242. Given the Cloudflare Workers origin, expect rapid domain rotation; defenders should also block newly observed Workers subdomains exhibiting similar naming patterns (e.g., randomized prefixes like 'nhgo-2xnx-cw12'). No SSL or HTTP anomalies are reported, so standard TLS interception will not aid detection. Further analysis should prioritize endpoint telemetry for credential submission attempts linked to this domain.