docusign-1vk[.]export-cellular-iberia-com-s-account[.]workers[.]dev

The domain docusign-1vk.export-cellular.workers.dev was registered on April 23, 2026 via Cloudflare Workers and currently resolves to IP 188.114.97.3, an address owned by Cloudflare, Inc. The site presents an HTTP 500 response with the page title "Worker threw exception | docusign-1vk.export-cellular-iberia-com-s-account.workers.dev | Cloudflare" and serves a Let’s Encrypt/E8 TLS certificate. Threat intelligence classifies the activity as a high‑risk brand impersonation targeting Cloudflare, with the underlying scam type identified as credential phishing. Sixteen of ninety‑one VirusTotal scanners flag the domain, Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one external blocklist; it is also listed by PhishDestroy as blocked. The infrastructure indicates a legitimate Cloudflare edge node being abused for malicious content, but the exact payload or phishing page has not been captured. Defenders should immediately block the domain and the associated IP at perimeter and DNS layers, enforce TLS inspection to capture any hidden content, and add the domain to internal blocklists. Continuous monitoring of Cloudflare‑issued subdomains for similar patterns is recommended, as the use of Workers allows rapid redeployment of malicious code.