fast-cedar-471[.]allcompredirectportalshare[.]workers[.]dev

Analysis as of July 29 2026 indicates that the domain fast-cedar-471.allcompredirectportalshare.workers.dev is actively employed for generic credential phishing. Infrastructure analysis reveals that the hostname resolves to the IP address 188.114.96.3, which is part of Cloudflare’s edge network and is associated with Cloudflare Workers, the service used for registration. The domain was created on February 08 2019, suggesting that the attacker has maintained the registration for several years, possibly to preserve reputation or to evade early detection.

Threat intelligence shows that the domain is listed on one public security blocklist and has been explicitly blocked by the PhishDestroy filtering service. VirusTotal scans have returned 14 positive detections out of 91 participating vendors, confirming that multiple commercial scanners consider the domain malicious. No public Safe Browsing, Open Threat Exchange (OTX) entries, or additional blocklist references were observed, and the page title or SSL certificate details have not been disclosed in the available data.

Consequently, the precise content served by the site, including any specific lure or credential‑capture mechanism, remains unknown. Defenders should prioritize network‑level blocking of the domain and its underlying IP address, incorporate the host into URL filtering and DNS sinkhole policies, and ensure that endpoint protection solutions are updated to reflect the 14 vendor detections. Continuous monitoring of DNS queries for the domain and periodic re‑scanning with VirusTotal or similar services are recommended to capture any changes in payload or hosting configuration.