msazure[.]azdatastore[.]workers[.]dev

Analysis of msazure.azdatastore.workers.dev indicates active malicious activity consistent with credential harvesting. The domain was created on June 12, 2026 and is hosted on Cloudflare Workers, resolving to the IP address 172.67.215.244. VirusTotal scans show that 6 of 91 security vendors have flagged the domain, providing independent confirmation of its malicious nature.

The site is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy filtering service, reinforcing the assessment that it is being used for phishing purposes. The elevated risk rating reflects the combination of recent registration, cloud-based hosting, and vendor detections. While the exact phishing payload and targeted brand are not disclosed in the available intelligence, the convergence of vendor flags, blocklist presence, and Cloudflare Workers deployment suggests a deliberately provisioned infrastructure for short‑lived or rapidly redeployed phishing campaigns.

Defenders should block the domain at network perimeter devices, update DNS filtering policies to include the associated IP address, and monitor for any outbound connections to 172.67.215.244. Continuous re‑evaluation is advised, as further analysis of page content or additional threat feeds may reveal specific credential‑stealing tactics or targeted entities. Until such details emerge, the precautionary controls recommended are to treat any traffic to msazure.azdatastore.workers.dev as hostile and to educate end users about unsolicited login requests that may originate from this domain.