raspy-frog-4e86[.]amdersonmarcus022[.]workers[.]dev

The domain raspy-frog-4e86.amdersonmarcus022.workers.dev is currently flagged as a high-risk generic phishing site targeting user credentials. Analysis confirms the domain remains active, with no specific brand impersonation identified at this stage. The infrastructure is designed to mimic legitimate login portals, a common tactic in credential harvesting campaigns. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on February 21, 2026, and resolves to the IP address 188.114.97.3, associated with AS13335 (Cloudflare, Inc.) in the United States. The domain appears on one security blocklist, and 13 of 95 vendors on a widely used threat intelligence platform have flagged it as malicious. The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is frequently exploited by threat actors to lend credibility to phishing pages. The page title 'Coming Soon' suggests the site may still be in a preparatory or testing phase, though this does not diminish its potential risk. Current status indicates the domain is operational and actively hosted. Organizations and individuals are advised to block access to this domain at the network level, particularly in environments where credential security is critical. End-users should avoid interacting with the domain, and security teams are recommended to monitor for related indicators of compromise, such as the IP address 188.114.97.3 or domains registered under the same workers.dev subdomain structure. Proactive measures, including user education on recognizing phishing attempts and implementing multi-factor authentication, are strongly encouraged to mitigate potential exposure.