75df6039-6a04-17a3-c392-docviewer2[.]rajesh-das1010[.]workers[.]dev

This domain, 75df6039-6a04-17a3-c392-docviewer2.rajesh-das1010.workers.dev, is currently listed on a single security blocklist and remains active as of the report date (July 29, 2026). The domain resolves to the IP address 172.67.212.40, which is a Cloudflare‑owned address. Registration information shows the domain was provisioned through Cloudflare, Inc., and no authoritative nameserver records were returned in the queried data set.

A VirusTotal analysis performed on 91 scanning engines returned no detections at the time of the scan; this absence of flags does not constitute a confidence indicator of benign behavior. The domain has also been observed on the PhishDestroy blocklist, indicating that at least one anti‑phishing feed has added it to its watchlist. No additional intelligence such as page title, SSL certificate details, HTTP response codes, or content signatures has been published, leaving the exact nature of the hosted payload unclear beyond the generic phishing classification supplied in the threat feed.

The lack of visible nameserver data and the reliance on Cloudflare's edge network are consistent with a transient hosting model often employed by threat actors to obscure infrastructure. Defenders should treat the domain as potentially malicious, block network resolution to 172.67.212.40, and add the full FQDN to URL filtering policies. Continuous monitoring of threat‑intel feeds for new detections, reputation changes, or content snapshots is recommended, as well as periodic re‑scanning with sandbox or endpoint detection tools to capture any evolving payloads.