rby-df87e[.]dwanna3[.]workers[.]dev

This domain rby-df87e.dwanna3.workers.dev was observed hosting a suspected phishing page protected by Cloudflare. The site returned HTTP 403 and presented the title “Suspected phishing site | Cloudflare”. Infrastructure analysis shows the domain resolves to IP 188.114.96.3, which belongs to AS13335 operated by Cloudflare in the United States. The domain is registered through Cloudflare, Inc., and uses HSTS and HTTP/3, confirming the presence of modern transport security.

VirusTotal has recorded 12 detections out of 94 scanned security vendors, indicating a moderate level of malicious classification. Independent blocklist services PhishDestroy, MetaMask and SEAL have already listed the domain, and it appears on three additional security blocklists. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. No authoritative nameservers were returned, and the domain is currently taken offline, returning a 403 response.

Evidence beyond the page title is not publicly available; the exact phishing lure, credential collection method, or target brand remain unknown. Defenders should add the IP address 188.114.96.3 and the fully qualified domain name to network‑level deny lists, ensure DNS filtering blocks the domain, and monitor for any re‑registration attempts. Continuous re‑scanning with multi‑engine services is recommended to capture any changes in detection rates. The combination of Cloudflare‑hosted infrastructure, multiple vendor detections, low trust score, and active blocklist listings supports a high‑risk rating for this phishing infrastructure.