hfjrk-jgcg-xrna[.]c-2xtasw30[.]workers[.]dev

This domain, hfjrk-jgcg-xrna.c-2xtasw30.workers.dev, is currently operating as an active generic phishing endpoint. Analysis indicates the infrastructure is designed to facilitate credential harvesting or malicious payload delivery, though no specific brand impersonation has been confirmed at this time. The site remains accessible and exhibits characteristics consistent with phishing campaigns, including a blank or loading page title, which is often used to evade initial detection while awaiting dynamic content injection. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on April 28, 2026, and resolves to the IP address 188.114.97.3, located in Canada and associated with Cloudflare's network. The domain is flagged by 15 of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious nature. It appears on at least one security blocklist and is actively blocked by enterprise phishing detection systems. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites due to its ease of acquisition and short-lived validity periods. The current status of this domain is active, with no signs of takedown or mitigation as of this report. Organizations and individuals are advised to block traffic to this domain at the network level, including its resolving IP address. Security teams should monitor for connections to 188.114.97.3 and the domain itself in logs, particularly those associated with user-initiated web traffic. Endpoint protection solutions should be updated to include this domain in phishing and malicious URL databases. Given the domain's hosting on Cloudflare Workers, which allows for rapid deployment and obfuscation, continuous monitoring for related subdomains or newly generated Worker routes is recommended.