cool-thunder-0cb2[.]karteriylailnuha6583[.]workers[.]dev

This domain, cool-thunder-0cb2.karteriylailnuha6583.workers.dev, is actively engaged in brand impersonation targeting Microsoft. The site is currently operational and presents a high-risk threat due to its deceptive content, which mimics legitimate Microsoft services to potentially harvest credentials or distribute malicious payloads. Analysis confirms the domain remains accessible as of the latest verification, with no takedown actions observed. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and resolves to the IP address 104.21.32.174, located in Canada. The domain was created on April 29, 2026, and is associated with a Let's Encrypt SSL certificate (serial number E7). Security telemetry indicates the domain appears on one blocklist and is flagged by 4 of 95 VirusTotal security vendors. The page title matches the domain name, suggesting minimal effort to disguise its purpose, while the use of Cloudflare Workers infrastructure aligns with common adversary tactics to evade detection and maintain operational resilience. Current risk assessment categorizes this domain as high severity due to its active status, brand impersonation tactics, and confirmed malicious indicators. Organizations are advised to implement immediate blocking of the domain and its associated IP address (104.21.32.174) at the network perimeter. Security teams should review logs for any connections to this domain or IP within the past 30 days and investigate potential credential exposure or unauthorized access. End-users should be alerted to avoid interaction with the domain, and any credentials entered on the site should be considered compromised. Continuous monitoring of Cloudflare Workers subdomains is recommended, as this infrastructure is frequently abused for phishing campaigns.