ScanMalware.com
Known malicious kitcriticalphishing

Cloudflare Workers Phishing Kits (device-code / EvilToken & brand lures)

family: cloudflare_workers_phishing
Short link:scanmalware.com/h/144

High-risk phishing kits hosted on Cloudflare Workers (*.workers.dev) — disposable gibberish-subdomain hosts impersonating brands (Adobe / Microsoft / DocuSign / GitHub / banks). Includes form-less device-code / OAuth-consent (EvilToken-style) kits that lure victims into authorising a Microsoft device code on the real identity provider, plus credential-harvest clones. Tracked by device-code phishing signals (a device-code screen or grant flow, a 'devicelogin' lure in the page text, *-s-account.workers.dev hosts), so it follows the family rather than individual sites.

Anchors

SMQL queryrun
device_code_phishing:true OR ocr:devicelogin OR domain:*-s-account.workers.dev

Provenance

Added: 2026-06-30 15:13
Created 2026-06-30 from a user-reported device-code / EvilToken kit (gcpu-…workers.dev: an Adobe Acrobat Sign lure leading to Microsoft device-code token theft).
References:

Sightings (768)Atom feed

Showing the 200 most recently scanned.

HostScanScriptMatchScanned
envelop-bxuw0zhi-8084fb.docdeployment.workers.devde587adf…—query2026-10-24 22:25
doc-portail-groupegouletsports.vercel.appbd3a8dfd…—query2026-10-24 18:04
doc-portail-groupegouletsports.vercel.appbe9026e1…—query2026-10-24 16:50
doc-portail-groupegouletsports.vercel.appd0eab18c…—query2026-10-24 15:45
doc-portail-groupegouletsports.vercel.appb81e0643…—query2026-10-24 15:45
facebook-xi-coral.vercel.app1a11faec…—query2026-10-24 01:45
msn-azure-portal.web.app693a7e47…—query2026-10-24 00:53
doc-portail-santacruzexpress.vercel.app115d554f…—query2026-10-24 00:45
auto-agreement-auth-east1.referred-east-1-auth.workers.deva635447e…—query2026-10-23 22:25
facebook-xi-coral.vercel.appd6b7ccae…—query2026-10-23 12:45
fseryy.pages.dev28f0486a…—query2026-10-23 01:45
fseryy.pages.dev684b17be…—query2026-10-22 15:45
ysk-8sahzjsn-82ab8f.ellen-4c2.workers.devc0a5be44…—query2026-10-21 22:25
wps-advisory.live-document-b03652830.workers.dev26c5b71f…—query2026-10-19 13:09
docusign-6gn.jhallman.workers.dev122b0a61…—query2026-10-18 16:25
facebook-login-redirect.blogspot.comcb2cfd7f…—query2026-10-17 13:42
secure-agreement-proposal-viewonce-application-journal.pages.dev9e71e7e9…—query2026-10-17 10:25
masterranktech.github.io4f80d415…—query2026-10-16 09:10
8yaz-k3zj-br05.cebsgroupsreceivables-ar-caesars-com-s-account.workers.dev7aa1de8d…—query2026-10-16 00:45
sharepoint-lod.sharepoint-online-mfa2-imap-mail-com-s-account.workers.dev38381e88…—query2026-10-15 14:17
adobe-cyyauijyipsxftqcbcmejpod.pages.devcb017ae4…—query2026-10-15 09:57
ghtmxpfauthideia3consult.us-sea-1.linodeobjects.com3d8e7ff9…—query2026-10-15 03:45
uk-facebook.blogspot.com0c625fb2…—query2026-10-14 22:05
linking-authenticator-secured-profile.pages.devf81162b4…—query2026-10-14 16:25
instagram-j088mh6ry-harsh3294.vercel.app29285d3a…—query2026-10-14 12:45
flow-note-zsgf.p-dthpnqnd.workers.dev166983db…—query2026-10-10 00:45
flow-note-zsgf.p-dthpnqnd.workers.devb2864a4d…—query2026-10-09 12:45
wahala-er-98gzp-0031f4.am2om247.workers.dev5e6b2eb0…—query2026-10-08 22:25
flow-note-zsgf.p-dthpnqnd.workers.devc3e3b209…—query2026-10-08 12:45
join.microsoft-teams-meetup.workers.dev5845261f…—query2026-10-08 08:49
teams-meeting-3884995.pages.dev7f8ad1fe…—query2026-10-08 08:48
teams-meeting-299945.pages.deva57cde78…—query2026-10-08 08:48
kkgh35nkgp-h04p.vercel.appb25dbe99…—query2026-10-08 00:45
jtds16u-hbku.vercel.app62bfc61d…—query2026-10-07 13:45
e33sr8lajfl5lxs3oxd.vercel.app50ea5895…—query2026-10-07 00:45
ivvy25ugqi-h04i.vercel.appe59d3d81…—query2026-10-07 00:45
ucrd77agvo-h04o.vercel.appb1e2a51d…—query2026-10-07 00:45
ymbb7ehcnzzxpfanknd.vercel.app02e92440…—query2026-10-06 12:45
ymbb7ehcnzzxpfanknd.vercel.app701a9424…—query2026-10-06 12:45
rbzj87hrhx-h02x.vercel.app12aa460b…—query2026-10-06 12:45
celistacabinetryproject.vercel.app6cafb21c…—query2026-10-06 12:45
adobe-knwrgjnwghnwhrkfnejwnfkje.pages.dev4ddbdddc…—query2026-10-06 10:52
sso.cuban.workers.devf6dcdec9…—query2026-10-06 07:54
celistacabinetryproject.vercel.app9c774a6c…—query2026-10-06 00:45
nmtp49wkoa-h05a.vercel.app3558ecc8…—query2026-10-06 00:45
doc-sig.github.io4bf7818d…—query2026-10-05 16:25
bh7iyqt09ppxrymmfjf.vercel.app23380902…—query2026-10-05 12:45
bh7iyqt09ppxrymmfjf.vercel.appdb96948b…—query2026-10-05 12:45
kxrlvnlybdnczbyyn6u.vercel.appf8c49890…—query2026-10-05 12:45
kxrlvnlybdnczbyyn6u.vercel.app36cd40c0…—query2026-10-05 12:45
fathom-cdn.b-cdn.net936a5673…—query2026-10-05 02:29
masterranktech.github.io9dd7d20d…—query2026-10-05 00:45
occupational-teal-igv2eku1fz-dpg3gufdn2l8.edgeone.dev83be9fc4…—query2026-10-03 13:07
a1ga5c9aidk28unglku.vercel.app8ea7c7bb…—query2026-10-03 12:45
dtzibmyjqoqmzej2cot.vercel.app3f382983…—query2026-10-03 12:45
qoqhrwfykobfkcf0epu.vercel.app953082f5…—query2026-10-03 12:45
qoqhrwfykobfkcf0epu.vercel.app158edbe0…—query2026-10-03 12:45
nwmswvg9siydksxtmte.vercel.appabdf74fb…—query2026-10-03 12:45
nwmswvg9siydksxtmte.vercel.appc14c9971…—query2026-10-03 12:45
dtzibmyjqoqmzej2cot.vercel.appcf0e5bf9…—query2026-10-03 12:45
a1ga5c9aidk28unglku.vercel.appab99a6ee…—query2026-10-03 12:45
v6npvwkatdm1zcuwk15.vercel.app28680062…—query2026-10-03 12:45
v6npvwkatdm1zcuwk15.vercel.app0485fed9…—query2026-10-03 12:45
esye39vumx-h01x.vercel.app686a2c69…—query2026-10-03 12:45
zqrj12wouj-h01j.vercel.app9ea7882e…—query2026-10-03 12:45
wcel17yenf-h01f.vercel.app4b871fbd…—query2026-10-03 12:45
qgjy41lzks-h01s.vercel.app306adc85…—query2026-10-03 12:45
fqzy14pnhx-h01x.vercel.app91e21833…—query2026-10-03 12:45
iukp08wjbu-h01u.vercel.appe66b131f…—query2026-10-03 12:45
vbzq63fanm-h01m.vercel.appa27f8858…—query2026-10-03 12:45
sjsw04fxiv-h01v.vercel.app8d99621d…—query2026-10-03 12:45
robl.vercel.appaf01b14f…—query2026-10-03 02:52
coinbase-referral-code.vercel.app0f140394…—query2026-10-03 00:53
ajbngnfotrkykwag36n.vercel.appc51be3fe…—query2026-10-02 12:45
ajbngnfotrkykwag36n.vercel.appb3de5a4f…—query2026-10-02 12:45
fseryy.pages.devfb7cf2cd…—query2026-10-02 01:45
fseryy.pages.dev7cf66d43…—query2026-10-02 01:45
75t7-h6gu-8j8z.jessica-axismechanicalnc-com-s-account.workers.dev94b05f0a…—query2026-10-01 09:18
docusign-9vs.jhon1213488-outlook-com-s-account.workers.dev7c4ad624…—query2026-10-01 09:18
docusign-6gn.jhallman.workers.dev4aa2b3f4…—query2026-10-01 09:18
docusign-glm.rough-rice-b41b.workers.dev0d56506f…—query2026-10-01 09:18
view-secured-document-ux0g.w-85rfst.workers.dev81faa9b2…—query2026-10-01 09:17
fseryy.pages.dev950c5fc2…—query2026-10-01 00:45
fseryy.pages.dev19c1421c…—query2026-10-01 00:45
botakpedasjeletot.pages.devff79b40b…—query2026-09-30 08:12
fseryy.pages.dev7b5afa49…—query2026-09-30 00:45
6fiycfwktmtg-hbk27.vercel.appd4632aac…—query2026-09-29 12:45
6fiycfwktmtg-hbk27.vercel.appb571fdf2…—query2026-09-29 12:45
iy2ol9dmgilpq-hbk28.vercel.appa501b833…—query2026-09-29 12:45
iy2ol9dmgilpq-hbk28.vercel.appd629a9ae…—query2026-09-29 12:45
zebcoindustrie-portal.vercel.app4addb243…—query2026-09-29 12:45
8gpv-tszw-jyrx.phil-heron-zoomdrain-com-s-account.workers.dev20805fcb…—query2026-09-29 12:45
n8o2-gg7f-efoz.alter-quintavious-dropoffs-org-s-account.workers.devb02cee6d…—query2026-09-29 12:45
cvtd56l-hbkl.vercel.app7efdf2d4…—query2026-09-29 12:45
fedf81-hbk27.vercel.appf95c8b73…—query2026-09-29 12:45
adobe-knwrgjnwghnwhrkfnejwnfkje.pages.dev922dcaf4…—query2026-09-29 09:52
sso.cuban.workers.dev9309737a…—query2026-09-29 06:53
e5zx9z9njsbb1db4jv6.vercel.appa54c8eda…—query2026-09-28 00:45
e5zx9z9njsbb1db4jv6.vercel.appee51f852…—query2026-09-28 00:45
td09yxlq5awmbpq6nyg.vercel.app5ffc2234…—query2026-09-28 00:45
td09yxlq5awmbpq6nyg.vercel.appd36e245f…—query2026-09-28 00:45
xatho5vqsukenlxz7pr.vercel.app42e9f438…—query2026-09-28 00:45
xatho5vqsukenlxz7pr.vercel.app08f4b5dd…—query2026-09-28 00:45
ybj55py7wtwlni5nuvz.vercel.app40c17729…—query2026-09-28 00:45
merrill-edge.vercel.appfba1df5b…—query2026-09-27 12:45
kr9j3urz4jdf25bollg.vercel.app99840e84…—query2026-09-27 12:45
kr9j3urz4jdf25bollg.vercel.appd2d60861…—query2026-09-27 12:45
klat12686-h25.vercel.app40b6fe1e…—query2026-09-27 12:45
yuem48180-h25.vercel.appc3469afa…—query2026-09-27 12:45
mqij32911-h25.vercel.app195c68ce…—query2026-09-27 12:45
ohwpw1xkeeasvjk70h2.vercel.appa9b61897…—query2026-09-26 12:46
ohwpw1xkeeasvjk70h2.vercel.appe327d6f4…—query2026-09-26 12:45
dfbaklgbh27eo-bhz25.vercel.app84c4ca21…—query2026-09-26 12:45
dfbaklgbh27eo-bhz25.vercel.appd27c0da6…—query2026-09-26 12:45
robl.vercel.app8250e46a…—query2026-09-26 01:50
proxy-test-001.pages.dev99541f57…—query2026-09-26 00:45
proxy-test-001.pages.devcb86a558…—query2026-09-26 00:45
coinbase-referral-code.vercel.app01115a19…—query2026-09-25 23:50
mhqmx2qnaxwvp8l19-hbk24b.vercel.app599d9356…—query2026-09-25 12:45
mhqmx2qnaxwvp8l19-hbk24b.vercel.app48bab9c0…—query2026-09-25 12:45
mhqmx2qnaxwvp8l19-hbk24b.vercel.app257fadbd…—query2026-09-25 12:45
2y84lu1dha3l5cmutke.vercel.appd5a19a6b…—query2026-09-25 12:45
2y84lu1dha3l5cmutke.vercel.app06322648…—query2026-09-25 12:45
go2mddf84ia0nd3g-hbk22.vercel.app13c21f84…—query2026-09-24 13:45
go2mddf84ia0nd3g-hbk22.vercel.app7ebeeac1…—query2026-09-24 13:45
prbb6orzjc99kcl60mq.vercel.appd207433d…—query2026-09-24 13:45
merrill-edge.vercel.app0bd27ceb…—query2026-09-24 13:45
qji11.vercel.app278eb1de…—query2026-09-24 13:45
gdbi73p-h20p.vercel.app4beec58a…—query2026-09-24 12:45
cdtc74o-h20o.vercel.appb00acf46…—query2026-09-24 12:45
prbb6orzjc99kcl60mq.vercel.app5146f8ba…—query2026-09-24 01:45
prbb6orzjc99kcl60mq.vercel.appd5f7206e…—query2026-09-24 01:45
proxy-test-001.pages.dev0ad2035d…—query2026-09-24 00:45
quiet-lab-c44b.b29e185437704fe0a494f89f.workers.dev400ed573…—query2026-09-24 00:45
searsce.coma2353257…—query2026-09-23 14:05
martins-bauer.comdfa830cd…—query2026-09-23 14:02
edge-edge-e7da3cbfb704853eb3.rentalescpade.workers.deve55ee437…—query2026-09-22 12:45
feno43-hbk20.vercel.appeb980839…—query2026-09-22 00:45
cjdq34-hbk20.vercel.appdd9a55ba…—query2026-09-22 00:45
ibjl93-hbk20.vercel.app9e4b58ef…—query2026-09-22 00:45
bspb77-hbk20.vercel.appfd48029d…—query2026-09-22 00:45
ptnf39-hbk20.vercel.app96d36da4…—query2026-09-22 00:45
lhcvvtw6wfkdc-hbk20.vercel.appf9f4894a…—query2026-09-21 12:45
8qot0mzb8mhrkq2iwbs.vercel.appf9cfad84…—query2026-09-21 12:45
p2iap8cckoeiz7zek4n.vercel.appdbd78421…—query2026-09-21 12:45
wuhfueovibnavphmhjt.vercel.app57c094dd…—query2026-09-21 12:45
vd4hy6lkykz7c1p1f3q.vercel.app46aabcdc…—query2026-09-21 12:45
t2mm31k7dsuitdqhw3p.vercel.app464aeb23…—query2026-09-21 12:45
raelhmbcjmiwer9ueur.vercel.app196401a4…—query2026-09-21 12:45
t2mm31k7dsuitdqhw3p.vercel.app2b429eb9…—query2026-09-21 12:45
raelhmbcjmiwer9ueur.vercel.appb1847937…—query2026-09-21 12:45
wuhfueovibnavphmhjt.vercel.appf6f7e44a…—query2026-09-21 12:45
vd4hy6lkykz7c1p1f3q.vercel.app181447c1…—query2026-09-21 12:45
lhcvvtw6wfkdc-hbk20.vercel.app919eea4c…—query2026-09-21 12:45
p2iap8cckoeiz7zek4n.vercel.app566f4be9…—query2026-09-21 12:45
8qot0mzb8mhrkq2iwbs.vercel.app5b0ea3d0…—query2026-09-21 12:45
proxy-test-001.pages.dev5bc843d0…—query2026-09-21 00:45
metoretonoris.vercel.appe14c57c0…—query2026-09-20 12:45
metoretonoris.vercel.appd1a20afe…—query2026-09-20 12:45
mail-drive-oj1g.p-2f66mze8.workers.devd529f1fe…—query2026-09-19 12:45
botakpedasjeletot.pages.dev61fffa71…—query2026-09-18 22:09
cicz40c-h10c.vercel.app8de5590f…—query2026-09-18 12:45
sukd58u-h10u.vercel.app5f94f84a…—query2026-09-18 12:45
9yap5maufuuo-hbk14.vercel.appafdb0043…—query2026-09-17 12:45
proxy-test-001.pages.deve92102e8…—query2026-09-16 12:45
instagram-clone-one-mu.vercel.app4b85a6d4…—query2026-09-16 02:45
5jkgnpeabvm0alad7cs.vercel.app82bf2074…—query2026-09-14 12:45
5jkgnpeabvm0alad7cs.vercel.app6f1776ed…—query2026-09-14 12:45
coiinbase-logiin.blogspot.co.ukbae96c59…—query2026-09-14 00:47
te19fgy1vslruxbkt8h.vercel.appcd1e033b…—query2026-09-14 00:45
te19fgy1vslruxbkt8h.vercel.appd665aa5a…—query2026-09-14 00:45
xej55ayx90zmm6blgnf.vercel.app822bd25a…—query2026-09-14 00:45
xej55ayx90zmm6blgnf.vercel.app43802c51…—query2026-09-14 00:45
tqcp-0b82-z1vw.alain-langlois-cinemacinema-ca-s-account.workers.devdf846b59…—query2026-09-13 12:45
kqid7e1vkh3d0r88k3d.vercel.app116a0344…—query2026-09-13 12:45
kqid7e1vkh3d0r88k3d.vercel.app4544c8ae…—query2026-09-13 12:45
v83cia3cumugxocgu10.vercel.appc77a8778…—query2026-09-13 00:45
khcnoydz4bnrl-hbk11.vercel.app417632f8…—query2026-09-13 00:45
khcnoydz4bnrl-hbk11.vercel.appe77d1bea…—query2026-09-13 00:45
nfyenkryj6v4oeqwluc.vercel.app9d2d28d0…—query2026-09-13 00:45
nfyenkryj6v4oeqwluc.vercel.app1d7e1ce6…—query2026-09-13 00:45
ejtgs7hmgzc00c87y3r.vercel.appce5fd2c9…—query2026-09-13 00:45
ejtgs7hmgzc00c87y3r.vercel.appa98b61fc…—query2026-09-13 00:45
8zerytt9lboomi1eygs.vercel.app9ff8b0c8…—query2026-09-13 00:45
8zerytt9lboomi1eygs.vercel.appc43c71b7…—query2026-09-13 00:45
quantum-auth.pages.dev748c571e…—query2026-09-12 18:13
secure-link-c96a.amcobisolutions.workers.dev0261cc64…—query2026-09-12 00:45
sp12ct-morsel-biz-kavren-holdik.pages.dev461795c0…—query2026-09-11 13:51
projectsapp-one.vercel.app206c1bdc…—query2026-09-10 13:45
myssuwww.staging.staging.www.ny.152-53-37-155.plesk.pagea9640769…—query2026-09-10 03:58
vow8ubo4zcpwalpcyjv.vercel.appe5c94955…—query2026-09-10 01:45
rfboszrqhnvrhepbubq.vercel.app61ab75b9…—query2026-09-08 13:45
rfboszrqhnvrhepbubq.vercel.app0f4e1b52…—query2026-09-08 13:45
projectsapp-one.vercel.appa4c02509…—query2026-09-08 12:45
definitive-electronics-qyjl.vercel.app0fe4e40a…—query2026-09-07 01:45
definitive-electronics-qyjl.vercel.app033916e0…—query2026-09-07 01:45
kdmw65x-h02x.vercel.appa636f46c…—query2026-09-06 15:45
dauc68n-h02n.vercel.appa32e779b…—query2026-09-06 15:45
iplh36o-h02o.vercel.app72cd143c…—query2026-09-06 15:45
adyo58x-h02x.vercel.app7d4da68e…—query2026-09-06 14:45