urlshort-linkmri0hvgk5adv[.]8go[.]workers[.]dev

The domain urlshort-linkmri0hvgk5adv.8go.workers.dev is currently active and hosted on the IP address 172.67.179.154, which belongs to Cloudflare’s edge network. Registration information shows the domain was provisioned through Cloudflare, Inc., and no authoritative nameserver records are publicly available (NS_NOT_FOUND). VirusTotal analysis records six of ninety‑one scanning engines flagging the domain as malicious, indicating a modest but noteworthy detection rate. The site is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, reinforcing its classification as a phishing vector.

The intelligence source categorises the threat as generic phishing with a high risk rating. Evidence beyond the infrastructure signals is limited; page title, SSL certificate details, and content analysis have not been published in the current feed. Consequently, the exact phishing payload or targeted brand cannot be confirmed at this time.

Defenders should treat the domain as hostile: network perimeter controls ought to deny outbound connections to the IP range, DNS filters should block the fully‑qualified domain name, and endpoint security solutions should enforce the VirusTotal detection verdict. Continuous monitoring for any new indicators, such as changes in payload delivery or additional blocklist entries, is recommended. Organizations that have observed traffic to this host should isolate affected systems and conduct forensic examination to determine whether credential harvesting or malware deployment occurred.