danf-up01[.]w16-oct[.]workers[.]dev

PhishDestroy identifies an active fake invoice delivery scam hosted on danf-up01.w16-oct.workers.dev, posing as a legitimate document delivery platform. This Workers.dev subdomain is weaponized to distribute malicious payloads or harvest credentials under the guise of delivering time-sensitive invoices. The threat is categorized as generic phishing with an undetermined risk level, pending further behavioral analysis.

This domain exhibits multiple indicators of compromise (IOCs) that warrant heightened scrutiny. VirusTotal scans show 0 detections out of 95 engines, indicating the payload remains undetected by current signatures. The domain resolves to IP 172.67.154.39, a Cloudflare infrastructure address commonly abused for evasive hosting. Registered via Cloudflare, Inc., the domain leverages Google Trust Services’ SSL certificate to mimic legitimate encryption, increasing its deceptive effectiveness. The Workers.dev subdomain framework suggests rapid deployment capabilities, allowing threat actors to spin up new instances with minimal effort. As of the latest analysis, there are no confirmed entries on public blocklists or threat intelligence feeds.

To mitigate exposure to this scam, users must avoid accessing danf-up01.w16-oct.workers.dev or any associated links claiming to deliver invoices. Enterprises should configure email filtering rules to block domains resolving to Cloudflare IPs or Workers.dev subdomains in unsolicited messages. Employees should verify document deliveries through official portals and report suspicious links immediately. Security teams are advised to monitor for SSL certificate issuance by Google Trust Services for Workers.dev subdomains outside approved workflows. Blocking IP 172.67.154.39 at the network perimeter may reduce accidental exposure.