net-web-wnqd[.]p-8r4315uz[.]workers[.]dev

This domain, net-web-wnqd.p-8r4315uz.workers.dev, is an active phishing endpoint hosted on Cloudflare's Workers platform, registered through Cloudflare, Inc. on April 13, 2026. Infrastructure analysis reveals it resolves to the IP address 172.67.138.58 (AS13335, United States) and presents a page titled 'Loading...', which is consistent with intermediary or obfuscation techniques used in phishing campaigns to delay or conceal malicious content. The domain currently returns an HTTP 200 status, indicating it is operational, and employs a Let's Encrypt SSL certificate (YE1) for encrypted communication. Detection data shows it is flagged by 11 of 91 security vendors on VirusTotal and appears on at least one blocklist, including PhishDestroy, which categorizes it as a generic phishing threat. The domain lacks traditional nameservers, a common characteristic of ephemeral or disposable infrastructure. Technologies detected include HSTS and HTTP/3, suggesting an attempt to appear legitimate while leveraging modern web protocols. The Gridinsoft trust score of 0/100 further corroborates its high-risk classification. At present, the specific brand or service being impersonated remains unconfirmed, as the page title provides no identifiable indicators. Defenders should treat this domain as an active threat, block it at the network level, and monitor for connections originating from internal systems. Given its Cloudflare Workers origin, takedown efforts may require direct engagement with the platform's abuse channels. No evidence of widespread compromise or targeted sector has been observed, but the domain's persistence and detection profile warrant continued scrutiny.