join-eligible-ede8[.]oppome7272[.]workers[.]dev

Analysis of join-eligible-ede8.oppome7272.workers.dev confirms it as an active phishing endpoint hosted on Cloudflare Workers infrastructure. The domain, registered on February 8, 2019, is currently flagged by 16 of 91 security vendors on VirusTotal and appears on four independent blocklists: PhishDestroy, MetaMask, ScamSniffer, and SEAL. These detections indicate high-risk phishing activity, though the specific brand or scam type targeted by the site remains unconfirmed due to limited page content analysis.

The domain operates under Cloudflare's workers.dev subdomain, a platform frequently exploited for rapid phishing deployment due to its ephemeral nature and lack of traditional hosting scrutiny. No associated IP, ASN, or SSL anomalies are documented in available intelligence, but the Workers platform's transient hosting model complicates long-term tracking. Defenders should prioritize blocking the full domain and monitoring for related subdomains under oppome7272.workers.dev.

Given the domain's presence on multiple high-confidence blocklists, automated takedown requests to Cloudflare are recommended, though response times may vary. Network-level protections should treat this domain as malicious until verified otherwise, with particular attention to potential credential harvesting or cryptocurrency-related fraud based on MetaMask and ScamSniffer detections.