data-form-f5at[.]p-lvqyivvk[.]workers[.]dev

Analysis indicates that the sub‑domain data-form-f5at.p-lvqyivvk.workers.dev is actively being used for phishing. The domain resolves to the IP address 104.21.35.113, which is part of Cloudflare’s globally distributed edge network. Registration details show the domain was provisioned through Cloudflare, Inc., a common platform for legitimate services as well as abuse. VirusTotal has recorded 13 detections out of 91 scanned engines, confirming that multiple security products have identified malicious behaviour associated with the host. The domain is listed on one public blocklist and is currently blocked by the PhishDestroy feed, reinforcing its classification as a phishing vector.

No additional metadata such as page title, SSL certificate details, or HTTP response codes have been published, and the authoritative nameserver information could not be retrieved (NS_NOT_FOUND). At present, no evidence of the specific landing page content or targeted brand has been released, so the exact phishing lure remains unknown. The limited visibility suggests that the site may be dynamically generated or that the attacker is deliberately minimizing static artefacts. Defenders should treat the domain as hostile.

Immediate actions include adding the fully qualified domain name to DNS‑based deny lists, configuring web‑proxy filters to block HTTP(S) requests to the host, and updating endpoint protection signatures that reference the 13 VirusTotal detections. Monitoring for new workers.dev sub‑domains that resolve to the same IP range is advisable, as attackers often spin up additional short‑lived endpoints. Because the infrastructure relies on Cloudflare’s edge, traditional IP‑based sinkholing may affect legitimate traffic; therefore, domain‑level blocking is preferred. Continuous re‑evaluation is recommended as further telemetry becomes available.