afj5-qi87-u2kv[.]saras-burnabynh-ca-s-account[.]workers[.]dev

Analysis on 30 July 2026 shows that the domain afj5-qi87-u2kv.saras-burnabynh-ca-s-account.workers.dev is actively used for credential phishing. The domain resolves to the IP address 172.67.128.187, which is owned by Cloudflare, Inc., indicating that the attacker is leveraging Cloudflare’s edge network for anonymity and resilience. No nameserver records were returned during DNS queries, suggesting that the domain is either using Cloudflare’s default DNS configuration or that the nameserver information is deliberately concealed.

VirusTotal reports that 12 of 91 security scanners label the domain as malicious, providing independent confirmation of its threat status. The domain is listed on two public phishing blocklists and is explicitly blocked by PhishDestroy and OpenPhish, reinforcing its classification as a high‑risk credential‑theft infrastructure. Registration details point to Cloudflare as the registrar, which does not reveal the true operator, a common tactic for fast‑flux or disposable phishing deployments.

The current status remains active, and no additional metadata such as SSL certificate details, HTTP response codes, or page titles have been published, leaving the exact content of the site unverified. Defenders should add the domain and its resolving IP address to network‑level deny lists, monitor Cloudflare‑associated traffic for anomalous patterns, and ensure that email filtering solutions reference the blocklists that already flag this host. Continuous re‑querying of DNS and blocklist status is recommended to capture any changes in hosting or takedown actions.