vault-access-pg0o[.]misty-pine-60bb[.]workers[.]dev

This domain, vault-access-pg0o.misty-pine-60bb.workers.dev, is flagged as an active high-risk credential phishing endpoint. Infrastructure analysis reveals it is hosted on Cloudflare's network, resolving to IP 104.21.56.45, and was registered on April 14, 2026. The domain is currently active, with a page title of 'Loading...', indicating either a placeholder or a dynamically loaded phishing kit. Security vendors have detected malicious activity, with 7 of 95 engines flagging the domain, and it appears on at least one security blocklist. The site employs HSTS, Cloudflare protections, and HTTP/3, suggesting an attempt to appear legitimate while leveraging modern web protocols to evade detection. No specific brand impersonation or phishing kit details are confirmed from the available data, though the subdomain 'vault-access' implies targeting of credential or sensitive data access portals. Defenders should treat this domain as hostile and prioritize blocking at the DNS or network level. The use of Let's Encrypt SSL certificates and Cloudflare hosting is consistent with phishing campaigns aiming to bypass basic security checks. Given the domain's recent creation and active status, further monitoring for related infrastructure or newly registered lookalike domains is recommended. No additional context about the intended victims or payload is available at this time.