shy-frog-7b74[.]wsf4e[.]workers[.]dev

This domain is classified as a high-risk credential harvesting scam, designed to deceive users into submitting sensitive authentication details through fraudulent login interfaces. Analysis indicates the infrastructure was specifically engineered for phishing operations, with technical indicators aligning with known credential theft campaigns. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on February 21, 2026, and resolves to the IP address 188.114.96.3, associated with AS13335 (Cloudflare, Inc.) in the United States. Security vendor detection on VirusTotal shows 14 out of 95 engines flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence platforms. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of phishing sites leveraging legitimate certificate authorities to appear trustworthy. Mitigation measures should include immediate blocking of the domain and its associated IP address (188.114.96.3) at the network perimeter. Users who may have interacted with the domain should be instructed to reset credentials for any accounts accessed during the exposure window, particularly if identical passwords were reused. Organizations should monitor for anomalous authentication attempts originating from the IP range associated with this campaign and review logs for connections to the domain prior to its takedown. Security awareness training should emphasize verification of domain authenticity before entering credentials, especially for sites hosted on content delivery networks.