muddy-credit-c341[.]cdo-labs-fair-hacker[.]workers[.]dev

This domain, muddy-credit-c341.cdo-labs-fair-hacker.workers.dev, is identified as a credential theft operation designed to harvest user login credentials through deceptive login portals. Analysis indicates no direct brand impersonation, but the infrastructure mimics legitimate authentication flows to trick victims into submitting sensitive information. The domain leverages Cloudflare Workers subdomains, a common tactic to evade detection and maintain operational agility. Infrastructure analysis reveals the following technical indicators: the domain was created on March 13, 2026, and is registered through Cloudflare, Inc. It resolves to IP address 172.67.187.118, hosted on AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Let's Encrypt (serial number E7). VirusTotal reports 15 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. No entries were found in Google Safe Browsing at the time of analysis. The domain remains active, posing a persistent risk to users who may encounter it through phishing campaigns. Response actions include blocking the domain at the DNS level and adding it to endpoint protection rules. Despite these measures, the risk of credential compromise persists due to the domain's use of Cloudflare infrastructure, which complicates takedown efforts. Organizations are advised to monitor for connections to 172.67.187.118 and educate users on recognizing subdomain-based phishing attempts, particularly those hosted on workers.dev.