misty-mud-7671[.]amdersonmarcus022[.]workers[.]dev

This domain, misty-mud-7671.amdersonmarcus022.workers.dev, is actively engaged in credential harvesting phishing operations. Analysis indicates the site is designed to mimic legitimate authentication portals, tricking users into submitting sensitive login credentials, including usernames, passwords, and potentially multi-factor authentication tokens. The deceptive infrastructure employs a 'Coming Soon' placeholder page, a common tactic to evade initial detection while awaiting deployment of the full phishing kit. The domain's architecture and hosting patterns suggest a targeted campaign aimed at corporate or financial service users, though the exact scope remains under investigation. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain is flagged by 13 out of 95 security vendors on VirusTotal, including detections for generic phishing and credential theft. Registered through Cloudflare, Inc. on February 21, 2026, the domain leverages Cloudflare's Workers platform (AS13335) and resolves to the IP address 188.114.96.3, a known Cloudflare proxy endpoint. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy. Despite its recent creation, the domain appears on one security blocklist, further corroborating its malicious intent. Users who have visited misty-mud-7671.amdersonmarcus022.workers.dev or interacted with its content should take immediate remedial action. All credentials potentially exposed to this domain must be considered compromised and reset across all platforms where they were reused. Enable multi-factor authentication on critical accounts to mitigate unauthorized access. Monitor financial and corporate accounts for anomalous activity, and report the incident to relevant security teams or incident response providers. Network administrators should block the domain and its resolving IP (188.114.96.3) at the perimeter to prevent further exposure.