form-cloud-t655[.]p-oejdzrsz[.]workers[.]dev

form-cloud-t655.p-oejdzrsz.workers.dev was registered on 2026-04-21 through Cloudflare, Inc. and resolves to the Cloudflare edge address 172.67.200.19, which geolocates to Canada. The site is served behind Cloudflare’s CDN and presents an active HTTPS endpoint with a Let’s Encrypt certificate (E8) and HTTP/3 support. HSTS is enforced, indicating the operator’s intent to maintain a persistent secure channel. VirusTotal analysis shows eight of ninety‑five scanning engines flag the domain as malicious, and the domain appears on a single public blocklist maintained by PhishDestroy. The HTTP response is a 500 Internal Server Error, and the page title returned is “Loading…”, suggesting that the malicious payload is either dynamically generated or currently unavailable. No nameserver information is disclosed, and the domain does not resolve to any additional IP addresses. The limited visible content, combined with the “Loading…” title and error status, points to a credential‑phishing campaign that likely serves a login‑clone page after the initial request. The specific brand or service being spoofed cannot be confirmed from the available data, so threat actors may be targeting a broad set of credentials or using a template that is swapped per campaign. The high risk rating reflects the recent creation date, active hosting, and the presence of security vendor detections. Defenders should block traffic to 172.67.200.19 for the affected domain and add the fully qualified name to proxy and DNS filtering rules. Monitoring of Cloudflare edge IP ranges for similar short‑lived domains can help catch related infrastructure. Incident response teams should treat any credential submissions to this domain as compromised and enforce password resets for affected accounts. Continuous threat‑intel feeds should be consulted for updates on the campaign’s evolution.