workers-playground-cold-violet-5b28[.]jusang425[.]workers[.]dev

The domain workers-playground-cold-violet-5b28.jusang425.workers.dev is associated with a high‑risk generic credential phishing campaign. Google Safe Browsing classifies the site as a social‑engineering threat, and 16 of 93 VirusTotal scanners have raised detections, confirming malicious intent. Independent reputation services assign extremely low trust scores: Gridinsoft records 0/100 and Scamadviser 1/100, indicating a near‑certain malicious profile. The domain resolves to IP address 104.21.93.142, which belongs to AS13335 Cloudflare, Inc., and is located in the United States.

The site presents the page title "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, suggesting that the underlying content is being blocked or hidden by Cloudflare protections. TLS is provided by a Google Trust Services / WE1 certificate, and the service uses HSTS, HTTP/3, and Cloudflare’s CDN infrastructure. The domain was registered on February 21, 2026 through Cloudflare, Inc., and is currently offline.

It has been listed on a single security blocklist and is actively blocked by the PhishDestroy sinkhole. Defenders should continue to block the domain and its resolving IP at perimeter and endpoint layers, monitor for any re‑registration attempts, and consider adding the host to internal threat intel feeds. Ongoing observation of Cloudflare‑associated IP ranges for similar patterns is advised, as the infrastructure may be reused for future phishing operations.