small-sunset-9dfe[.]gwendienicolls98[.]workers[.]dev

This domain is flagged as a credential harvesting phishing endpoint targeting users through deceptive login interfaces. Analysis indicates the site mimics legitimate authentication portals to capture usernames, passwords, and session tokens, likely for account takeover or unauthorized access to corporate or personal services. The infrastructure is designed to evade initial detection, as evidenced by its minimal footprint in security telemetry. Infrastructure analysis reveals the domain was registered on April 29, 2026, via Cloudflare Workers, a platform commonly abused for rapid deployment of malicious endpoints. It resolves to IP address 172.67.140.178, hosted within a content delivery network in Canada. The SSL certificate, issued by Let's Encrypt (serial E7), provides encrypted communication to lend credibility to the phishing attempt. Despite its active status, the domain appears on only one security blocklist, and VirusTotal reports 0/95 detections, indicating low initial visibility among security vendors. Users who have visited small-sunset-9dfe.gwendienicolls98.workers.dev should immediately terminate any active sessions and reset credentials for any accounts entered on the site. Network administrators are advised to block the domain and its resolving IP (172.67.140.178) at the perimeter. Endpoints that accessed the domain should be scanned for malware or unauthorized modifications, and logs should be reviewed for signs of credential exfiltration or lateral movement. If multi-factor authentication was not enabled on compromised accounts, it should be enforced immediately to mitigate further risk.