enquiry-walock-tcap23nqu[.]springcapital91[.]workers[.]dev

This domain, enquiry-walock-tcap23nqu.springcapital91.workers.dev, is identified as a generic phishing threat targeting user credentials. Analysis of the page title fragment 'Sh' suggests potential impersonation of a legitimate service or brand, though no specific brand or drainer kit association has been confirmed. The domain exhibits characteristics typical of credential harvesting campaigns, including minimal content exposure and rapid deployment patterns. Infrastructure analysis reveals the domain is registered through Cloudflare, Inc., resolving to IP address 104.21.50.97. VirusTotal detection metrics show 15 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy. The domain appears on one security blocklist and is currently categorized with an elevated risk level. No creation date metadata is available, but the workers.dev subdomain structure indicates recent deployment via Cloudflare's serverless platform. The domain has been taken offline, likely following detection by automated security systems. Despite its current inactive status, residual risk remains due to potential reuse of the infrastructure or repurposing of the phishing kit. Organizations should monitor for related indicators, including the resolving IP 104.21.50.97 and SSL certificate patterns. Network security teams are advised to block the domain at perimeter defenses and investigate any prior connections from internal assets. End users should be alerted to verify domain authenticity before entering credentials, particularly for services with similar naming patterns.