workoff[.]org

This domain, workoff.org, is actively serving a phishing page designed to harvest user credentials under the guise of a service branded as 'WorkOff.' Registered on February 19, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the site remains operational as of July 12, 2026, resolving to the IP address 172.67.189.84, which is geolocated to a Cloudflare node in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (mariah.ns.cloudflare.com and rodney.ns.cloudflare.com) and a Let's Encrypt SSL certificate with serial number E8, indicating a typical setup for low-cost, high-availability phishing campaigns. The site employs multiple tracking and fingerprinting technologies, including Google Analytics, Facebook Pixel, FingerprintJS, and Cloudflare Browser Insights, which are often leveraged to profile victims and evade detection. The presence of Tailwind CSS and jsDelivr suggests a modern, template-based frontend, while the use of HTTP/3 further aligns with current phishing kit trends aimed at improving load times and bypassing legacy security controls. The domain is currently flagged by one security blocklist and has been detected by 5 out of 95 security vendors on VirusTotal, with a trust score of 32/100 from Gridinsoft and 26/100 from Scamadviser, reinforcing its malicious classification. While the exact target brand or impersonated service remains unclear, the page title 'WorkOff' and the use of generic phishing infrastructure suggest a broad credential harvesting campaign. The site returns an HTTP 200 status, confirming its active state. Defenders should prioritize blocking the domain and its resolving IP at the network level, while also monitoring for related indicators such as the SSL certificate serial or nameserver patterns. Given the use of Cloudflare, sinkholing or takedown efforts may require coordination with the CDN provider to fully disrupt the operation.