sync-store-ur85[.]p-lboid22u[.]workers[.]dev

Sync‑store‑ur85.p‑lboid22u.workers.dev is currently active and serves a page whose title returns “Loading…”. The domain was registered on April 15 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 172.67.144.175, which is announced by AS13335 in the United States. TLS termination is provided by a Let’s Encrypt certificate (YE2) and the site enforces HSTS while supporting HTTP/3.

Network analysis shows the host is protected by Cloudflare’s edge services, and the domain’s DNS records are not publicly disclosed (nameservers reported as NS_NOT_FOUND). The site returns HTTP 200 on every request, confirming the presence of a functional web server. The page title “Loading…” is a common indicator of a placeholder page used in credential‑harvesting campaigns.

Reputation services assign a zero‑score on the Gridinsoft trust metric (0/100) and the domain appears on a single external blocklist. VirusTotal scans have flagged the domain by 13 of 95 security vendors, and the phishing‑specific blocklist PhishDestroy has already listed it. These signals, combined with the high‑risk classification, point to a credible generic phishing operation targeting users who may be lured by a seemingly innocuous loading screen.

Defenders should block the domain at network perimeter and ensure any browser or email gateway that resolves to 172.67.144.175 is prevented from loading content. Continuous monitoring of Cloudflare‑hosted IP ranges for similar patterns is advised, and incident response teams should treat any credential submissions to this site as compromised. Further forensic investigation of traffic logs may reveal additional infrastructure components that support the campaign.