hidden-pine-6aad[.]refat-sexcpt[.]workers[.]dev

This domain, hidden-pine-6aad.refat-sexcpt.workers.dev, is actively engaged in fake login phishing operations designed to harvest user credentials. Analysis indicates the site is currently live and operational, presenting a high-risk threat to unsuspecting visitors. No specific brand impersonation has been confirmed, but the infrastructure and page title suggest a credential-theft focus. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Cloudflare, Inc., and resolves to the IP address 104.21.28.124, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1). Security vendors have flagged this domain as malicious, with 10 of 95 VirusTotal engines detecting it. It appears on one security blocklist and is actively blocked by network security systems. The page title, 'Coming Soon,' is a common tactic to mask malicious intent while the backend is prepared for phishing operations. Current status confirms the domain remains active, posing an ongoing threat. Organizations and users are advised to block the domain and its associated IP address (104.21.28.124) at the network level. Security teams should monitor for connections to this domain in logs and investigate any endpoints that have interacted with it. End-users should be educated on recognizing phishing indicators, such as unexpected 'Coming Soon' pages or requests for login credentials on unfamiliar domains. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended.