keepalive[.]update-defender[.]workers[.]dev

Analysis indicates that the domain keepalive.update-defender.workers.dev was registered on March 10 2026 through Cloudflare, Inc. The authoritative name resolves to 172.67.185.236, an address owned by AS13335 Cloudflare, Inc. and geolocated in the United States. The site presented a HTTP 403 response with the page title “Service unavailable”. TLS termination is provided by a Google Trust Services certificate issued to WE1, and the connection negotiates HTTP/3 with HSTS enabled. Infrastructure fingerprints show the use of Azure Front Door and broader Azure services in addition to Cloudflare front‑end, suggesting a multi‑cloud hosting profile often employed by malicious operators to increase resilience. Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on a single external blocklist that is currently enforced by PhishDestroy.

Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal scans returned 19 positive detections out of 94 submitted security vendors, confirming that multiple commercial scanners have identified the domain as malicious. The observed scam type is credential phishing, targeting user credentials through deceptive pages, although the exact credential‑harvesting vector has not been publicly disclosed. The domain is presently offline, and no live content is available for further behavioural analysis.

Consequently, the precise payload, landing‑page structure, or exfiltration mechanisms remain unknown. Defenders should continue to block the domain at network perimeter devices, update DNS filtering policies, and monitor for any resurrection of the host or related sub‑domains. Continuous re‑scanning on VirusTotal and periodic checks of Cloudflare‑registered assets are recommended to detect potential re‑use of the same infrastructure.