download-worksheets[.]net

Analysis of download-worksheets.net indicates an active phishing domain registered on July 19, 2026, through AppCroNix Infotech Private Limited (d/b/a VEBONIX.com). The domain currently resolves to IP address 172.67.176.140 and is hosted on Cloudflare nameservers james.ns.cloudflare.com and magdalena.ns.cloudflare.com. As of July 22, 2026, the domain appears on one security blocklist, having been flagged by PhishDestroy. No detections were recorded among the 95 vendors that scanned the domain on VirusTotal, though the absence of detections does not confirm safety. The domain's content and specific target remain unconfirmed, as no brand impersonation or phishing kit details have been identified in available intelligence.

The name 'download-worksheets' suggests a possible education or academic-themed lure, but no evidence confirms this as the exact scam type. Infrastructure analysis reveals Cloudflare hosting, which is frequently used by both legitimate and malicious actors to obscure origin servers. The registrar, VEBONIX.com, has been associated with other recently registered domains under investigation for phishing activity, though no direct pattern has been established in this case. Defenders are advised to treat this domain as suspicious based on its recent registration, single blocklist appearance, and lack of prior reputation.

Network-level blocking or monitoring of 172.67.176.140 is recommended until further analysis confirms its intent. Additional scrutiny of domains registered through the same registrar within the past 72 hours may reveal related infrastructure. No SSL certificate details or HTTP response codes were provided in available intelligence, limiting assessment of server-side behavior. The domain remains active, and continued monitoring is warranted.