2dzl-umko-ou34[.]tom-macsystemsltd-co-uk-s-account[.]workers[.]dev

The domain 2dzl-umko-ou34.tom-macsystemsltd-co-uk-s-account.workers.dev is identified as credential phishing infrastructure targeting UK-based service accounts. Analysis confirms the domain is currently offline, though it previously hosted content designed to harvest authentication details from users under the guise of a legitimate service provider. Infrastructure analysis reveals the domain was flagged by 15 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0 out of 100. It appears on one security blocklist and is blocked by PhishDestroy. The domain resolves to the IP address 188.114.97.3, registered through Cloudflare, Inc. Detected technologies include HSTS, Cloudflare, and HTTP/3, while the SSL certificate is issued by Google Trust Services. No creation date is available, but the domain's structure and naming convention suggest an attempt to impersonate a UK-based service entity. Current status indicates the domain has been taken offline, though similar infrastructure may remain active. Organizations are advised to block the domain and associated IP address (188.114.97.3) at the network perimeter. Security teams should monitor for variations of the domain pattern, particularly those using the "workers.dev" subdomain or mimicking UK service providers. End-user training should emphasize verification of domain authenticity before entering credentials, especially for services involving financial or administrative access.