rx03-qe8k-40xp[.]tom-macsystemsltd-co-uk-s-account[.]workers[.]dev

The domain rx03-qe8k-40xp.tom-macsystemsltd-co-uk-s-account.workers.dev was first observed on February 08 2019. It resolves to IP 188.114.96.3, an address associated with Cloudflare’s edge network. Registration is handled through Cloudflare Workers, indicating the site is likely hosted on Cloudflare’s serverless platform rather than a traditional web‑host. VirusTotal reports that 16 of 91 security engines have flagged the domain, which aligns with its classification as a credential‑phishing infrastructure.

The domain is currently listed on the PhishDestroy blocklist and appears on a single additional security blocklist. No public Safe Browsing, OTX, SSL certificate details, HTTP response codes, or page‑title information have been released for this host. The absence of such telemetry limits visibility into the exact phishing landing page and target brand, but the available indicators are sufficient to treat the domain as malicious. Defenders should block outbound and inbound traffic to 188.114.96.3, add the fully qualified domain name to DNS sinkhole or firewall deny lists, and monitor for any queries to the workers.dev sub‑domain.

Continuous re‑scanning on VirusTotal or similar platforms is advised to capture any changes in detection scores. Logging of TLS handshake metadata may also reveal additional clues about the underlying Cloudflare‑originating service. Organizations should educate users about credential‑phishing attempts and enforce multi‑factor authentication to reduce impact should credentials be compromised.