g20j-c9rv-o3yh[.]iris-investore-net-s-account[.]workers[.]dev

This domain, g20j-c9rv-o3yh.iris-investore-net-s-account.workers.dev, is identified as an active credential theft phishing operation designed to harvest user login credentials through deceptive login portals. Analysis indicates the site employs brand impersonation techniques, likely mimicking legitimate financial or investment platforms to trick victims into entering sensitive account details. The infrastructure is structured to resemble authentic services, increasing the likelihood of successful credential compromise for subsequent unauthorized access or financial fraud. Infrastructure analysis reveals concrete evidence supporting the elevated risk classification. The domain is flagged by 19 out of 95 security vendors on VirusTotal, indicating widespread detection of malicious intent. It appears on at least one security blocklist, further corroborating its fraudulent nature. Registered through Cloudflare, Inc., the domain resolves to the IP address 104.21.11.20 and utilizes an SSL certificate issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users. The page title, Suspected Phishing | Cloudflare, suggests the hosting provider has also identified and flagged the content as malicious. Users who visited this domain or entered credentials on any associated page should take immediate action to mitigate potential compromise. First, reset passwords for any accounts that may have been exposed, prioritizing financial, email, and other high-value services. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unauthorized activity, including logins, transactions, or changes to personal information. If financial details were entered, contact relevant institutions to report potential fraud and request account monitoring. Additionally, scan local devices for malware, as credential theft sites may deploy additional payloads to maintain persistence or exfiltrate further data.