broken-violet-4e7chd02[.]lori183[.]workers[.]dev

The domain broken-violet-4e7chd02.lori183.workers.dev is currently active and serves a 302 redirect, indicating it forwards visitors to another location. It is hosted behind Cloudflare’s network (IP 188.114.96.3, located in Canada) and was provisioned through Cloudflare Workers, a common technique for rapidly deploying malicious pages. TLS is provided by Let’s Encrypt (certificate type E7), which masks the underlying intent of the site. Independent analysis by PhishDestroy has already added the domain to a blocklist, and Google Safe Browsing flags it for social engineering, confirming that the URL is being used to harvest credentials or personal data. VirusTotal reports that 15 of 91 security vendors have flagged the domain, reinforcing the malicious categorisation. The domain appears on one additional security blocklist, further evidencing its abuse. No public page content or specific brand impersonation has been disclosed, so the exact lure and victim profile remain unknown. Defenders should immediately block the domain at perimeter and DNS layers, monitor for outbound connections to the associated IP, and add the URL to URL filtering policies. Ongoing surveillance of Cloudflare Workers activity and periodic re‑scanning with sandbox tools is advised to detect any evolution of the payload or redirection targets.