rough-tree-6756[.]avbrf[.]workers[.]dev

Domain rough-tree-6756.avbrf.workers.dev is a recently activated generic phishing site designed to harvest user credentials under the guise of a GravePay login page. The lure mimics the legitimate payment provider’s interface, leveraging Cloudflare Workers to skirt traditional hosting restrictions while obscuring backend infrastructure. No draineer kit artifacts have been publicly disclosed, but the payload appears to simply POST harvested data to a back-end collector and displays a fake ‘session expired’ message. Initial telemetry shows the page stays online for roughly 48–72 hours before Cloudflare Workers terminates the worker instance, indicating a disposable campaign targeting time-sensitive credential theft.

Forensic pivot points are minimal but precise. VirusTotal currently reports 0 detections out of 95 scanners, confirming this strain is under the radar. The domain is registered through Cloudflare, Inc. and resolves to 172.67.218.71 via a Let’s Encrypt SSL certificate issued on 2024-05-30. Creation date aligns with worker deployment, around 2024-05-30 09:41:32 UTC. Google Safe Browsing does not yet blacklist the domain, and public blocklists (Abuse.ch, OpenPhish, PhishTank) show zero listings as of this advisory. The worker script remains active at the time of writing, but historical worker logs reveal a median uptime of 54 hours before takedown.

Current status is active with a risk level of under_investigation. Rapid takedown is unlikely while the worker remains live, so immediate local blocking is advised. SOC teams should add 172.67.218.71 and rough-tree-6756.avbrf.workers.dev to DNS, proxy, and IDS blocklists. Users should avoid entering any credentials and report encounters for forensic enrichment. Residual risk stems from the short-lived nature of Workers deployments, which allows adversaries to rapidly recycle infrastructure and evade long-term detection; therefore, continuous monitoring of newly created Cloudflare Workers hostnames is critical.