index-yv6[.]oliver-thevaluexchange-co-uk-s-account[.]workers[.]dev

The domain index-yv6.oliver-thevaluexchange-co-uk-s-account.workers.dev was registered on April 23, 2026 via the Cloudflare Workers platform and resolves to the IP address 172.67.209.49, which is associated with Cloudflare, Inc. in Canada. The site serves a TLS certificate issued by Let’s Encrypt (E8) and returns HTTP 500 with the page title “Worker threw exception | index-yv6.oliver-thevaluexchange-co-uk-s-account.workers.dev | Cloudflare,” indicating a misconfigured or intentionally failing Cloudflare Worker. Intelligence classifies the activity as a high‑risk brand‑impersonation campaign targeting Cloudflare, described as a “Fake Exchange” scam. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. Automated reputation services assign a Gridinsoft trust score of 0 / 100, and VirusTotal reports 12 of 91 security vendors flagging the domain as malicious. The infrastructure is limited to the Cloudflare edge network, with no additional hosting or ancillary services identified. Defenders should block the domain at DNS and proxy layers, monitor for similar Workers‑based subdomains, and incorporate the observed indicators—creation date, IP, TLS fingerprint, and blocklist status—into detection rules. Current evidence does not reveal any payload or credential‑collection pages, so further forensic sampling of the worker script is recommended if access becomes possible.