vaeg-8bcp-7bkr[.]tgopaul-foundrymortgagecapital-com-s-account[.]workers[.]dev

The domain vaeg-8bcp-7bkr.tgopaul-foundrymortgagecapital-com-s-account.workers.dev is identified as a phishing threat, with 12 out of 91 VirusTotal vendors marking it as malicious. It is currently active and hosted on an IP address in the United States under Cloudflare, Inc. The domain is also listed on two public blocklists, including PhishDestroy and OpenPhish, indicating its recognition as a threat.

This domain operates under the guise of a legitimate service, potentially targeting users with phishing attacks aimed at stealing sensitive information. The SSL certificate is issued by Let's Encrypt, which is commonly used for legitimate sites but can also be exploited by malicious actors to create a false sense of security. The platform risk score is notably high at 93 out of 100, underscoring the potential danger it poses to unsuspecting users.

Despite its recent detection on June 22, 2026, the domain's malicious activity has been swiftly identified by multiple security vendors. This rapid detection highlights the effectiveness of collaborative threat intelligence efforts in identifying and mitigating phishing threats. The use of Cloudflare's infrastructure suggests an attempt to leverage reputable services to enhance the credibility of the phishing operation.

Overall, the domain vaeg-8bcp-7bkr.tgopaul-foundrymortgagecapital-com-s-account.workers.dev exemplifies a sophisticated phishing scheme, utilizing both advanced hosting services and SSL encryption to deceive users. Its presence on public blocklists and the high risk score should prompt immediate caution for any potential interactions with this domain.