urlshort-linkmqnzgonvyhlm[.]askonyuh[.]workers[.]dev

This domain, urlshort-linkmqnzgonvyhlm.askonyuh.workers.dev, is actively impersonating Cloudflare as part of a high-risk phishing operation. Registered on June 23, 2026, through Cloudflare, Inc., the domain resolves to IP address 188.114.97.3 and is currently flagged by at least one security blocklist, including PhishDestroy. The page title explicitly references Cloudflare, stating 'Suspected Phishing | Cloudflare,' which aligns with the identified brand impersonation threat type. Infrastructure analysis reveals the use of Cloudflare-hosted services, including Workers.dev, alongside standard web technologies such as Tailwind CSS, HSTS, and HTTP/3. The SSL certificate is issued by Google Trust Services, a common practice for both legitimate and malicious domains. Two out of ninety-five security vendors on VirusTotal have flagged this domain, though the specific detection context remains unverified. The domain's trust score is 0/100, reinforcing its suspicious status. While the exact content and functionality of the site have not been analyzed, the available indicators—such as the page title, registration details, and hosting infrastructure—strongly suggest an intent to deceive users by mimicking Cloudflare's branding. Defenders should treat this domain as malicious and prioritize blocking or monitoring access to it. Additional investigation into associated infrastructure, such as resolving IP addresses or related domains, may provide further context for mitigation efforts.