kkhm-62ja-vye4[.]philip-turnkeytalk-com-s-account[.]workers[.]dev

This domain is an active credential phishing site designed to harvest login credentials by impersonating legitimate authentication portals. Victims are typically redirected through malicious links in emails or compromised websites, where they encounter fake login pages mimicking corporate or financial services. The goal is to trick users into entering sensitive information such as usernames, passwords, or multi-factor authentication codes, which are then captured by threat actors for unauthorized access or financial fraud. Analysis indicates the domain is hosted on Cloudflare Workers infrastructure and resolves to the IP address 104.21.7.151, associated with AS13335 (Cloudflare, Inc.). The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. As of the latest scan, 6 out of 95 security vendors on VirusTotal have flagged this domain as malicious. The domain appears on at least one security blocklist, and its registration details align with patterns observed in phishing campaigns leveraging Cloudflare's free tier services to evade detection. If you or someone in your organization visited this domain or entered credentials on a page resembling a login portal, immediate action is required. First, reset all passwords associated with the account, prioritizing email, financial, and work-related services. Enable multi-factor authentication if not already active. Monitor accounts for unauthorized activity, such as unfamiliar logins or transactions. Notify your organization's security team or IT support to conduct a forensic review of the affected device. If personal data was exposed, consider reporting the incident to relevant data protection authorities. Avoid interacting with any links or attachments from suspicious emails, and verify the legitimacy of login pages by checking the URL and SSL certificate details before entering credentials.