file-sync-tczr[.]p-77iqt3w6[.]workers[.]dev

The domain file-sync-tczr.p-77iqt3w6.workers.dev is currently operating as an active phishing site specializing in brand impersonation, specifically targeting Google. Analysis of the page title, which displays 'Google,' confirms the intent to deceive users into believing they are interacting with legitimate Google services. This campaign appears designed to harvest credentials or distribute malicious payloads under the guise of a trusted brand. Infrastructure analysis reveals the domain is hosted on Cloudflare Workers infrastructure, registered through Cloudflare, Inc., and resolves to the IP address 142.251.154.119, which is geolocated in the United States under AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Let's Encrypt (identifier YE2), a common choice for both legitimate and malicious domains. Detection data indicates the domain is flagged by 2 of 95 security vendors on VirusTotal, while only one security blocklist currently includes it. The low detection rate suggests the campaign may still be in an early or evasive phase, potentially avoiding broader scrutiny. Given the active status of this phishing domain, organizations and end-users are advised to implement immediate mitigations. Network-level blocking of the domain and its resolving IP (142.251.154.119) is recommended to prevent access. Security teams should monitor for indicators of compromise, including unexpected authentication attempts or anomalous traffic patterns associated with Google services. End-users should be educated to verify domain authenticity before entering credentials, particularly when redirected from unexpected links. Continuous monitoring of Cloudflare Workers subdomains is advised, as this infrastructure is frequently abused for phishing operations.