atmcwltdfg45[.]dava[.]workers[.]dev

The domain atmcwltdfg45.dava.workers.dev is a generic phishing site designed to steal user credentials through credential phishing. It does not impersonate a specific brand or use a known drainer kit. As of the latest verification, the site has been taken offline, but it previously posed a risk of harvesting login details from unsuspecting visitors.

Technical indicators show that atmcwltdfg45.dava.workers.dev was registered through Cloudflare, Inc. on February 26, 2026, and resolved to the IP address 172.67.188.17, hosted by Cloudflare in the US. VirusTotal recorded 0 of 95 vendor detections, and Google Safe Browsing did not flag the domain. However, it appeared on 1 security blocklist (PhishDestroy). The SSL certificate was issued by Let's Encrypt / E8, and the observed page title was 'Suspected phishing site | Cloudflare'. Technologies detected included HSTS, Cloudflare, and HTTP/3, with an HTTP status of 403 at the time of assessment. Gridinsoft assigned a trust score of 0/100.

Users who may have interacted with atmcwltdfg45.dava.workers.dev should immediately change passwords for any accounts accessed during the potential exposure, enable two-factor authentication (2FA), and monitor accounts for unauthorized activity. Report the domain to relevant platforms, such as PhishTank or the Anti-Phishing Working Group, to aid in broader mitigation efforts. If financial or cryptocurrency credentials were entered, contact the respective service providers for further guidance.