black-math-cbc3[.]dakriacreuielwtxea[.]workers[.]dev

The domain black-math-cbc3.dakriacreuielwtxea.workers.dev is currently active and has been classified as a generic phishing site. VirusTotal records show that 12 of 91 scanning engines have flagged the domain, indicating that a notable minority of security products recognize malicious behavior. The domain resolves to the IP address 104.21.29.210, which is part of Cloudflare's edge network and is commonly used by abuse operators to hide origin infrastructure.

The domain is listed on a single public blocklist and has been explicitly blocked by the PhishDestroy feed, suggesting that at least one dedicated anti‑phishing service has observed malicious activity linked to this host. Registration data reveals that the domain was created on February 08, 2019 and was provisioned through Cloudflare Workers, a service that enables rapid deployment of serverless scripts and can be abused to host transient phishing pages. No public page title, SSL certificate details, or brand‑target information are available, so the exact content served by the site remains unverified.

Defenders should treat the domain as hostile: add the domain and its resolving IP to DNS block or sinkhole policies, ensure that web proxy and URL filtering solutions reference the PhishDestroy feed and any other blocklists that include the host, and monitor for any outbound connections to the 104.21.29.210 address. Given the modest detection count and limited blocklist presence, continuous re‑evaluation is advised, as threat actors may adapt the site or reuse the infrastructure for new campaigns.