executioncopy-7f6[.]vpuri-outpastmgt-com-s-account[.]workers[.]dev

This domain, executioncopy-7f6.vpuri-outpastmgt-com-s-account.workers.dev, is actively engaged in credential theft through brand impersonation tactics. Analysis indicates the infrastructure mimics legitimate account management portals to harvest login credentials, session tokens, or multi-factor authentication codes. The domain specifically targets users by presenting fraudulent login interfaces that replicate corporate or financial service providers, increasing the likelihood of successful compromise through social engineering. Infrastructure analysis reveals the domain was registered through Cloudflare Workers on April 15, 2026, and currently resolves to IP address 172.67.153.221, hosted by Cloudflare, Inc. in Canada. Security vendor detection on VirusTotal stands at 16 out of 95, indicating moderate but growing recognition of its malicious nature. The domain appears on one security blocklist and uses a Let's Encrypt SSL certificate (serial number E7), which provides a false sense of legitimacy to potential victims. The page title, 'Worker threw exception,' suggests either a deliberate obfuscation technique or a misconfigured phishing kit. Users who have visited executioncopy-7f6.vpuri-outpastmgt-com-s-account.workers.dev should immediately revoke any active sessions associated with the credentials entered. Reset passwords for all accounts accessed from the same device or network during the exposure window, prioritizing financial, email, and identity management services. Enable multi-factor authentication where available, using app-based or hardware tokens rather than SMS or email-based methods. Monitor accounts for unauthorized access or transactions, and report the incident to the impersonated service provider. Network administrators should block the domain and its resolving IP (172.67.153.221) at the perimeter to prevent further exposure within their environments.