upold34dhgff[.]shaylie-1[.]workers[.]dev

The domain upold34dhgff.shaylie-1.workers.dev was first observed on February 21 2026 and is currently recorded as taken offline. DNS resolution points to the Cloudflare edge address 104.21.31.122, an IP owned by AS13335 (Cloudflare, Inc.) located in the United States. The site serves HTTPS with a certificate issued by Google Trust Services under the WE1 root, and the server advertises HTTP/3 and HSTS, indicating modern protocol support. An HTTP request to the root path returns a 403 status code and the page title reported by the scan is "Suspected phishing site | Cloudflare", which aligns with the generic credential‑phishing classification supplied in the intelligence feed.

Reputation services assign a trust score of 0/100 on both Scamadviser and Gridinsoft, and Google Safe Browsing flags the URL for social engineering. VirusTotal analysis records 15 of 93 scanning engines flagging the domain as malicious, reinforcing the high‑risk rating. The domain is listed on one public security blocklist and has been actively blocked by the PhishDestroy remediation service. The registrar entry shows registration through Cloudflare, Inc., consistent with the hosting infrastructure.

No additional page content, targeted brand, or specific phishing lure has been captured beyond the generic title, so the precise credential‑collection technique remains unknown. Defenders should add the fully qualified domain name to web‑filter deny lists, enforce DNS sinkholing for the resolved IP, and correlate internal logs for any connections to 104.21.31.122. Because the IP belongs to a shared Cloudflare edge network, contextual filtering based on URL patterns and the observed 403 response is recommended to avoid false positives on legitimate Cloudflare traffic. Continuous re‑scanning and monitoring of the workers.dev namespace for new sub‑domains that resolve to the same edge IP are advised, as the threat actor may reactivate the site or spawn additional phishing assets.