1bfe98b0-6714-be4c-3bf4-docviewer[.]rajesh-das1010[.]workers[.]dev

This domain is currently flagged under investigation for credential theft, a specific phishing threat targeting user login credentials through deceptive login portals or fake authentication prompts. Analysis indicates the domain is designed to mimic legitimate document viewers or cloud-based file access services, increasing the likelihood of successful credential harvesting from unsuspecting users. Infrastructure analysis reveals the domain resolves to IP address 172.67.212.40, a Cloudflare-hosted endpoint. The domain is registered through Cloudflare, Inc., leveraging their Workers.dev platform. As of the latest scan, the domain has 0/95 detections on VirusTotal, indicating no current antivirus or security vendor flags. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. No creation date is publicly available, and the domain remains unlisted on major blocklists or threat intelligence feeds. Trust scores from automated analysis platforms are neutral due to the lack of prior detections. Mitigation steps specific to credential theft threats include immediate blocking of the domain and its resolving IP (172.67.212.40) at the network perimeter. Security teams should deploy endpoint protection rules to detect and prevent access to the domain, particularly on systems handling sensitive data. User awareness training should emphasize the risks of entering credentials on unverified document viewer or cloud access portals. Organizations are advised to monitor for unusual authentication attempts or failed login patterns that may indicate compromised credentials. If internal access is detected, initiate password resets for affected accounts and review logs for lateral movement or data exfiltration attempts.