auth-office-device-com[.]dporozok[.]workers[.]dev

Analysis as of July 29 2026 indicates that the domain auth-office-device-com.dporozok.workers.dev is actively used in a generic phishing campaign. The domain is hosted behind Cloudflare, Inc., which is listed as the registrar. DNS resolution points to the IP address 188.114.96.3, an address known to be part of Cloudflare’s edge network. VirusTotal has recorded 13 of 91 security vendors flagging the domain as malicious, demonstrating moderate consensus among scanners.

The domain is currently listed on one public security blocklist and is explicitly blocked by the PhishDestroy service, confirming that at least one anti‑phishing platform has observed abusive activity tied to the host. No authoritative nameserver records were returned, which may indicate that the domain relies on Cloudflare’s proxy DNS service rather than exposing its own nameservers. The available evidence does not reveal the specific landing page content, SSL certificate details, or HTTP response codes, so the exact phishing vector remains unknown. Nevertheless, the combination of a Cloudflare‑registered domain, malicious detections on VirusTotal, and inclusion on blocklists suggests a high probability that the host is being leveraged to deliver credential‑stealing or account‑verification pages.

Defenders should block or sinkhole the domain at the network perimeter, update URL filtering rules to include the full host, and monitor outbound traffic for connections to 188.114.96.3. Continuous re‑scanning of the domain on multi‑engine platforms is advised to capture any changes in detection status. Organizations that receive suspicious emails referencing Microsoft Office or authentication workflows should treat any link to this domain as malicious until a thorough manual investigation can confirm otherwise.