pages-sessions-imp0rtant-docs040934bfdn832nsd3q2-o1io[.]w-jq6bm6[.]workers[.]dev

The domain pages-sessions-imp0rtant-docs040934bfdn832nsd3q2-o1io.w-jq6bm6.workers.dev is currently classified as an elevated‑risk generic phishing indicator. The registration timestamp is 08 February 2019, and the name was provisioned through the Cloudflare Workers service, a pattern frequently observed in abuse campaigns that leverage short‑lived edge compute resources. DNS resolution points to the IPv4 address 188.114.96.3, an IP that is shared among multiple Cloudflare‑hosted worker endpoints and does not, by itself, reveal additional malicious infrastructure.

Threat intelligence feeds have placed the domain on a single blocklist, specifically PhishDestroy, confirming that at least one security organization has taken active mitigation steps. VirusTotal analysis shows that 11 of 91 scanning engines have flagged the domain, indicating a modest but non‑trivial consensus of malicious behavior across independent scanners. No public SSL certificate details, HTTP status codes, page titles, or brand‑targeting information are presently available, leaving the exact phishing payload or lure undefined.

Defenders should update perimeter filters to block the full hostname and its parent zone, monitor DNS queries for the associated IP, and consider adding the domain to internal blacklists. Continuous re‑evaluation is advised, as further reconnaissance could uncover additional indicators such as payload URLs, credential‑stealing forms, or compromised third‑party assets.