drive-edge-lzl0[.]p-8pd549l5[.]workers[.]dev

Analysis of the domain drive-edge-lzl0.p-8pd549l5.workers.dev indicates active credential phishing infrastructure as of July 12, 2026. The domain, registered through Cloudflare, Inc. on April 15, 2026, resolves to IP address 172.67.207.194, associated with AS13335 (Cloudflare, Inc.) in the United States. No nameservers are currently configured, and the domain presents a Let's Encrypt SSL certificate issued under the identifier YE2. The HTTP response status is 200, though the page title remains 'Loading...', suggesting either a placeholder or obfuscated content awaiting dynamic rendering. Infrastructure analysis reveals the use of Cloudflare services, including HTTP/3 and HSTS enforcement, which may complicate detection or takedown efforts. The domain is flagged by one security blocklist and has been classified as a high-risk credential phishing threat. Twelve of ninety-one security vendors on a multi-engine scanning platform have detected the domain as malicious, though the specific payload or targeted brand remains unconfirmed due to the absence of detailed page content analysis. Defenders should prioritize monitoring or blocking traffic to this domain, particularly given its association with Cloudflare Workers, a platform frequently exploited for rapid deployment of phishing pages. The domain's creation date and current activity suggest it is part of an ongoing campaign, though further investigation is required to determine the exact phishing kit or targeted service. No additional indicators of compromise, such as associated email addresses or historical WHOIS data, are currently available for correlation.