mrtm-ywoc-dm31[.]rdials-compasslabservices-com-s-account[.]workers[.]dev

The domain mrtm-ywoc-dm31.rdials-compasslabservices-com-s-account.workers.dev was registered on June 08, 2026 through Cloudflare Workers infrastructure. Analytical data shows the domain is actively used in a credential‑phishing campaign, as indicated by its classification and by the fact that 13 of 91 VirusTotal scanners have flagged it. The site has been added to a single security blocklist and is currently blocked by the PhishDestroy mitigation service.

No additional public intelligence such as ASN, geographic location, SSL certificate details, or HTTP response codes has been released, and the page title or content has not yet been publicly analyzed. Consequently, the precise lure, target brand, or credential‑capture mechanism remains uncertain. Nonetheless, the combination of recent creation, Cloudflare Workers hosting, and multiple vendor detections points to a purpose‑built phishing infrastructure.

Defensive recommendations include immediate DNS and proxy level blocking of the full subdomain, inclusion of the domain in URL filtering rules, and heightened monitoring for outbound connections to workers.dev subdomains. Organizations should also consider applying heuristic detection for Cloudflare Workers‑based phishing patterns and reviewing any internal logs for attempts to contact this domain. Ongoing intelligence collection is advised to capture any future changes in hosting, page content, or associated indicators that could refine remediation actions.