werknest[.]io

This domain, werknest.io, is flagged as a credential theft scam. It poses a significant risk to users by attempting to steal login credentials and other sensitive information. The threat is designed to mimic legitimate websites, tricking users into entering their credentials on a fake login page, which are then captured by the attackers.

Analysis indicates that werknest.io is still active and has been flagged by 7 out of 95 security vendors on VirusTotal. The domain was created on May 28, 2026, and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 104.21.66.60, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The site is also known to appear on 3 security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL.

If a user has visited werknest.io, they should immediately change their passwords for any accounts that may have been compromised. It is recommended to run a full system scan using reputable antivirus software to ensure no malware has been installed. Users should also monitor their financial accounts and credit reports for any unusual activity. Reporting the incident to the relevant security team or IT department can help in mitigating the risk and preventing further damage.