portaldocliente-dossie[.]acessosc[.]workers[.]dev

This domain, portaldocliente-dossie.acessosc.workers.dev, is actively engaged in credential theft operations targeting users through a fraudulent security verification page titled 'Verificação de Segurança.' The page is designed to harvest login credentials by impersonating legitimate security checks, likely targeting Portuguese-speaking users or organizations. The use of encoding artifacts in the page title ('Verificação de Segurança') suggests poor handling of character sets, a common red flag in hastily deployed phishing infrastructure. Analysis of the domain reveals multiple indicators of malicious activity. The domain is flagged by 1 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist, specifically PhishDestroy. Infrastructure analysis shows the domain is hosted on Cloudflare Workers, a platform frequently abused for deploying phishing pages due to its ease of use and low cost. The domain was registered on May 05, 2026, an unusual future date that may indicate an attempt to evade detection or an error in registration data. The SSL certificate is issued by Let's Encrypt (serial number E7), and the domain resolves to the IP address 188.114.96.3, located in Canada and associated with Cloudflare, Inc. Users who have visited portaldocliente-dossie.acessosc.workers.dev or entered credentials on the site should take immediate action. First, reset any passwords entered on the page, particularly if reused across other services. Enable multi-factor authentication on all critical accounts to mitigate the risk of unauthorized access. Monitor financial and communication accounts for signs of compromise, such as unauthorized transactions or messages. If the domain was accessed in a corporate environment, report the incident to the organization's security team for further investigation and potential containment measures. Avoid interacting with the domain or any links associated with it.