tight-bread-3fd8[.]zmfkc29[.]workers[.]dev

Analysis of the domain tight-bread-3fd8.zmfkc29.workers.dev indicates it is an active phishing endpoint hosted on Cloudflare's Workers platform. The domain was registered through Cloudflare, Inc., and currently resolves to the IP address 172.67.161.47, a Cloudflare-operated address. As of July 21, 2026, the domain remains active and is flagged on one security blocklist, specifically by PhishDestroy. No nameservers are associated with the domain, which is consistent with Cloudflare Workers deployments that do not require traditional DNS configurations. VirusTotal scans conducted by 95 vendors returned no detections, though this absence does not confirm safety or legitimacy. The domain has not been widely analyzed by other threat intelligence platforms, and no additional context—such as the targeted brand, phishing kit, or specific scam type—is available in current intelligence. The exact content of the page remains unanalyzed, and no page title or HTTP response details have been provided. Infrastructure analysis reveals the domain leverages Cloudflare's edge network, a common tactic to evade IP-based blocking and obscure hosting origins. Defenders should treat this domain as suspicious due to its presence on a security blocklist and its association with a known phishing classification. Organizations are advised to monitor network traffic for connections to 172.67.161.47 or the domain itself, apply appropriate blocking measures, and conduct further investigation if internal systems have interacted with this endpoint. Given the lack of widespread detection, additional scrutiny is warranted to determine the scope and intent of this campaign.