ScanMalware.com
Known malicious kitcriticalphishing

Cloudflare Workers Phishing Kits (device-code / EvilToken & brand lures)

family: cloudflare_workers_phishing
Short link:scanmalware.com/h/144

High-risk phishing kits hosted on Cloudflare Workers (*.workers.dev) — disposable gibberish-subdomain hosts impersonating brands (Adobe / Microsoft / DocuSign / GitHub / banks). Includes form-less device-code / OAuth-consent (EvilToken-style) kits that lure victims into authorising a Microsoft device code on the real identity provider, plus credential-harvest clones. Tracked by device-code phishing signals (the device-code flow, a 'devicelogin' lure in the page text, *-s-account.workers.dev hosts) and the EvilTokens loader YARA rule, so it follows the family rather than individual sites.

Anchors

SMQL queryrun
device_code_phishing:true OR ocr:devicelogin OR domain:*-s-account.workers.dev

Provenance

Added: 2026-06-30 15:13
Created 2026-06-30 from a user-reported device-code / EvilToken kit (gcpu-…workers.dev: an Adobe Acrobat Sign lure leading to Microsoft device-code token theft).
References:

Sightings (200)

HostScanScriptMatchWhen
paymentsecurelink.vercel.app0d689b1d…—query2026-10-15 14:51
vormela-kxt-belfora-p7t4dw83.pages.dev9eb16e78…—query2026-10-15 14:47
sharepoint-lod.sharepoint-online-mfa2-imap-mail-com-s-account.workers.dev38381e88…—query2026-10-15 14:18
bermora-vrk-felmavi-p5t4hc91.pages.dev753cefa0…—query2026-10-15 13:59
marzuri-mpt-qafqelo-k9x4pe63.pages.dev09f6c034…—query2026-10-15 13:48
sp22ct-pemav-biz-raku-zeli.pages.dev7c460ffe…—query2026-10-15 13:47
moonlit-horse-8b9a8d.netlify.app0e047ee7…—query2026-10-15 13:46
sp18ct10-lenvak-biz-zomeri.pages.dev087dc9cf…—query2026-10-15 13:46
sp22ct-nelok-biz-kavi-zaru-e8p.pages.dev8d20129a…—query2026-10-15 12:51
sp22ct-kemav-biz-zori-lenu-3bk.pages.deva3bb308f…—query2026-10-15 12:51
w8r2f-4m0-70s8-mtl7k-14-10-2026-aa.pages.deva0303d12…—query2026-10-15 12:51
pfxmz53hwu-wtrkb81fyn-9k7i4g-yk755c.pages.devf43cbca2…—query2026-10-15 12:51
marqula-kxt-belorun-c2x6dw84.pages.deveac2f7ac…—query2026-10-15 12:50
sp10ct10-burvek-biz-qureni-zavra.pages.devd900f436…—query2026-10-15 12:50
sp18ct10-turvok-biz-qemavi.pages.deva413b7ee…—query2026-10-15 12:50
sp18ct10-xarnok-biz-vumelo-6xr.pages.devc3b1c325…—query2026-10-15 12:50
sp1ct10-nurval-biz-rumzo-kelri-btr.pages.dev422d7bc2…—query2026-10-15 12:50
4h4r-nshdde-dxv3kv-cmr-fxl5r.pages.devfa71d84c…—query2026-10-15 12:50
qemzavi-kxt-belorun-c5x4hk91.pages.devbea605b9…—query2026-10-15 12:50
burqani-mpt-felzavo-p5d9ka84.pages.dev67bae553…—query2026-10-15 12:50
sp33ct-taleko-biz-vurani-meravo.pages.dev041209e1…—query2026-10-15 12:50
g0xba-5of-y4cg-m7nky-30-09-2026-hh.pages.deva7bd39bb…—query2026-10-15 12:50
sp18ct10-kurnek-biz-zaveli.pages.devece3970c…—query2026-10-15 12:49
sp21ct-lavem-biz-raku-zeti.pages.dev88d3b2de…—query2026-10-15 12:49
wrojf-54f-z111-5kg3b-14-10-2026-aa.pages.dev8b88df43…—query2026-10-15 12:49
sp15ct-lavqor-biz-nurzel-vexan.pages.devbfb15850…—query2026-10-15 12:49
lhjnd34wtr-cvqgs82ykt-8h3f1g-pf492d.pages.dev85c72450…—query2026-10-15 12:49
8iu3-0ti-1v4pz-hy26r6-e2ub.pages.dev8d030022…—query2026-10-15 12:49
9hgp0-wiw-3k4u-bwsjq-30-09-2026-hh.pages.dev324416c4…—query2026-10-15 12:49
sp22ct-pelor-biz-nemi-zaru.pages.dev1a6d721b…—query2026-10-15 12:48
sp18ct10-burnak-biz-vemiro.pages.devbcbc313a…—query2026-10-15 12:48
sp18ct10-vulrek-biz-zanero.pages.dev9bd4573d…—query2026-10-15 12:48
sp18ct10-yurnek-biz-zavelo.pages.dev6182259a…—query2026-10-15 12:48
sp22ct-noriv-biz-maku-zeli.pages.dev412515cb…—query2026-10-15 12:47
sp1ct10-furrek-biz-lumqo-vemri.pages.dev1b094a50…—query2026-10-15 12:47
sp18ct10-murlek-biz-qanavi.pages.dev397fbeeb…—query2026-10-15 12:47
sp22ct-nemik-biz-kavi-zaru-1ub.pages.dev459519ea…—query2026-10-15 12:47
xelquro-kxt-zervani-r2t8dw94.pages.dev6c4527e8…—query2026-10-15 12:47
5gb69-aba-yg7j-o1f39-30-09-2026-hh.pages.devf1a1c7a4…—query2026-10-15 12:47
norveta-kxt-zenlavi-c3x9dw52.pages.devf933429e…—query2026-10-15 12:47
lerveta-kxt-borvani-r5t9dp71.pages.devc7c3f8a5…—query2026-10-15 12:47
sp18ct10-bavlek-biz-vunero.pages.devd70510e7…—query2026-10-15 12:46
sp22ct-zarur-biz-loru-kemu.pages.deve5d0f61a…—query2026-10-15 12:46
sp22ct-vemak-biz-keli-pazu.pages.dev401de942…—query2026-10-15 12:46
mt1xv-55n-xil2-hbkcy-30-09-2026-hh.pages.dev36fd5e59…—query2026-10-15 12:46
buzqari-mpt-felvuno-p4d9ka86.pages.devfca1333d…—query2026-10-15 12:46
royal-vip-hacke-1-dptqqzt3pi7l.edgeone.dev4061ff44…—query2026-10-15 12:18
pub-96c79f0345b64cb0b52868ee83d279e0.r2.devced152c3…—query2026-10-15 11:55
okabdt-ai-dpnwg2mcehfr.edgeone.dev25b28ea6…—query2026-10-15 11:34
adobe-cyyauijyipsxftqcbcmejpod.pages.devcb017ae4…—query2026-10-15 09:59
zafqaro-mpt-vulfeni-k7x3pe85.pages.dev7b3f88d2…—query2026-10-15 08:46
auth-device-online.firebaseapp.comc7b97b55…—query2026-10-15 06:55
auth-device-online.web.app48dba76c…—query2026-10-15 06:55
pub-1219515ffb7d4e5aae720b520e5d45e8.r2.devfffc83ff…—query2026-10-15 06:54
5n811-r3g-oqhr-niv3f-21-09-2026-aa.pages.deva39ec322…—query2026-10-15 05:47
burvani-mpt-zefqelo-h8d4ka77.pages.devd7764f1a…—query2026-10-15 05:20
pub-d23d5dcc47bc4f528130d9bd8570a877.r2.devc4d021b9…—query2026-10-15 03:57
ghtmxpfauthideia3consult.us-sea-1.linodeobjects.com3d8e7ff9…—query2026-10-15 03:48
clktp6agpxo-kphzwmja-4f5g7c-clk61c.pages.dev8722f01d…—query2026-10-15 03:20
tmod-servey.netlify.app0b9c6614…—query2026-10-15 02:54
tmod-servey.netlify.app8b92be4d…—query2026-10-15 02:54
gmail-support.netlify.appae8f1655…—query2026-10-15 02:51
wtcer-tdu-tsgc-geqob-13-10-2026-aa.pages.dev5cb907c4…—query2026-10-15 02:51
vormita-kxt-qelmora-r2t6dp94.pages.dev244f7fe7…—query2026-10-15 02:51
zunqaro-mpt-felvani-h7d6ka84.pages.dev50b1ea86…—query2026-10-15 02:50
f2bshgrrwj.vercel.appa3793505…—query2026-10-15 02:49
t7eck-9yp-0d4y-2mtfi-01-10-2026-hh.pages.devbdb5720b…—query2026-10-15 02:48
daqzani-mpt-qelvuro-k7x6pe95.pages.dev15bdc497…—query2026-10-15 02:48
leanl.vercel.app6494fc56…—query2026-10-15 02:48
gmail-support.netlify.app3cf50122…—query2026-10-15 01:50
sp31ct-tavuno-biz-nurvi-kazem.pages.dev13a607dd…—query2026-10-15 01:48
iyiolashop-dp7roh6cyz4t.edgeone.dev2579f69b…—query2026-10-15 01:41
leanl.vercel.app22a40d74…—query2026-10-15 01:09
pub-339ed1e572c44e38b332b62b38f3360c.r2.dev8f90223a…—query2026-10-15 01:02
helpcenterauth.web.app8ac025ed…—query2026-10-15 01:00
food-flood-30999609.firebaseapp.com8b21fe8a…—query2026-10-15 00:58
food-flood-30999609.web.app7e1dfa72…—query2026-10-15 00:58
helpcenterauth.firebaseapp.coma22a47c1…—query2026-10-15 00:56
pub-1904fcafb89a4eaaa354dadaabc46627.r2.devefb5a7ca…—query2026-10-15 00:53
sp12ct-pramik-biz-zoldor-kersel.pages.devb5cca76f…—query2026-10-15 00:51
stickersapp.vercel.app71097f02…—query2026-10-15 00:47
uk-facebook.blogspot.com0c625fb2…—query2026-10-14 22:07
mervani-mpt-qazluro-t4d8ka95.pages.dev6b4dbdfd…—query2026-10-14 20:36
okomanifeoko.edgeone.dev0e9ddf55…—query2026-10-14 19:51
security-server-static-page--atmpd1.replit.appa937002d…—query2026-10-14 18:51
static-website-environment--docu-sign-auth.replit.appdb26a065…—query2026-10-14 18:51
security-auth-device.firebaseapp.comcaa8cc07…—query2026-10-14 17:56
security-auth-device.web.app89382638…—query2026-10-14 17:56
stickersapp.vercel.appff3e9ede…—query2026-10-14 17:53
stickersapp.vercel.app08f11377…—query2026-10-14 17:53
f2bshgrrwj.vercel.appfd3f3f1b…—query2026-10-14 17:51
sp33ct-selavo-biz-dunaro-vumeki.pages.devad5b803c…—query2026-10-14 16:49
sp18ct10-ravnak-biz-luremi.pages.dev51c00441…—query2026-10-14 16:48
sp15ct-lumeli-biz-kovex-padar.pages.deve49cc493…—query2026-10-14 16:47
sp32ct-qorel-biz-mavun-zetik.pages.deva6e7e10f…—query2026-10-14 16:47
puzzled-amaranth-nxhyynuq-dpklcr7088kv.edgeone.dev801f4745…—query2026-10-14 16:27
linking-authenticator-secured-profile.pages.devf81162b4…—query2026-10-14 16:26
pub-339ed1e572c44e38b332b62b38f3360c.r2.devade27fcd…—query2026-10-14 15:55
pub-339ed1e572c44e38b332b62b38f3360c.r2.dev4b89bf95…—query2026-10-14 15:55
pub-e0fbd798f1254106a8d627bd480831e7.r2.dev9fab5be9…—query2026-10-14 15:55
sp10ct10-zelvak-biz-qureko-pelra.pages.dev00c50526…—query2026-10-14 15:49
sp33ct-kunero-biz-zalavi-fomuto.pages.devc3f8d26f…—query2026-10-14 15:48
qazfeni-mpt-vurqaro-r5x7me89.pages.dev907039ff…—query2026-10-14 15:21
xavzora-kxt-belmavi-p7t2dc89.pages.devc1cb50b3…—query2026-10-14 14:48
sp20ct-hersom-biz-velqik-pranok.pages.devd7c2d25e…—query2026-10-14 14:48
gabhd-j39-kp9y-wqr8h-30-09-2026-hh.pages.deve010cd4c…—query2026-10-14 14:47
sp21ct-ravur-biz-melo-kazi.pages.dev7869dd3a…—query2026-10-14 14:46
sp10ct10-murvek-biz-rumeni-zavra.pages.dev0d65a23e…—query2026-10-14 13:46
sp14ct-pravik-biz-hurnel-zastor.pages.devc67c7622…—query2026-10-14 13:39
pub-579c928d1ca14fda8f9e1344aecc2784.r2.dev0e145c28…—query2026-10-14 12:56
22cu0i-20zkk-7s8-i96d9n-w9z.pages.devf93b6705…—query2026-10-14 12:50
sp21ct-varek-biz-nimu-kelo.pages.dev6ff1bea0…—query2026-10-14 12:50
sp21ct-rivem-biz-naku-zelo.pages.devf99c75af…—query2026-10-14 12:50
sp33ct-mavelo-biz-zunaro-faneki.pages.devfd2f590d…—query2026-10-14 12:50
0m8u6-af8-h3hs-3hph8-13-10-2026-aa.pages.dev8cdb0c39…—query2026-10-14 12:50
sp1ct10-gunval-biz-zurzo-kelri-dp0.pages.devf50da59e…—query2026-10-14 12:50
instagram-j088mh6ry-harsh3294.vercel.app29285d3a…—query2026-10-14 12:50
zafvuro-mpt-qelmari-h8d3ka75.pages.dev93cdb4ac…—query2026-10-14 12:50
sp21ct-tavik-biz-nelo-kura.pages.devba4b3804…—query2026-10-14 12:50
ledger-production-6g0.pages.dev0ed4ed96…—query2026-10-14 12:50
xwfd-gzb3b-dhwsnh-0vy6-sqg.pages.dev17cecbb6…—query2026-10-14 12:49
sp21ct-zavok-biz-miru-kela.pages.dev40f7f2a8…—query2026-10-14 12:49
zafqani-mpt-vurvelo-h4d8ka954.pages.dev0713c2e5…—query2026-10-14 12:49
ledger-staging-9yb.pages.deve627ba1c…—query2026-10-14 12:49
3x0al-cps-le4z-wrzcq-13-10-2026-aa.pages.dev733a7093…—query2026-10-14 12:48
raqfelo-mpt-qunvani-p6d4ka89.pages.devf052f3b1…—query2026-10-14 12:48
mavquri-mpt-zelqano-k5x9pe73.pages.dev8e61454e…—query2026-10-14 12:48
sp1ct10-hurrek-biz-rumzo-vemti-wuy.pages.deve97009b0…—query2026-10-14 12:48
cuif1-21r-eapm-60kkc-13-10-2026-aa.pages.dev6c865d15…—query2026-10-14 12:47
sp1ct10-bunrek-biz-lumqo-varti.pages.dev5bada06a…—query2026-10-14 12:47
sp15ct-raveli-biz-funox-zelar.pages.dev931a16ec…—query2026-10-14 12:47
f2bshgrrwj.vercel.app6e98385c…—query2026-10-14 12:47
marnufi-mpt-zelqavo-h8d3ka65.pages.dev30acfa45…—query2026-10-14 12:47
hpacs-0vm-jn71-vsdv4-13-10-2026-aa.pages.dev7a3d07d4…—query2026-10-14 12:47
sp21ct-kemvi-biz-ranu-pelo.pages.deved13b7e8…—query2026-10-14 12:46
zunquri-mpt-vafqelo-k4x7pe81.pages.devfe280d3d…—query2026-10-14 12:46
raqfuro-mpt-zelqani-h7d9ka64.pages.dev6fb61d3a…—query2026-10-14 12:46
qenfelo-mpt-vuzqari-k6x4pe91.pages.dev617bb2be…—query2026-10-14 12:46
pub-15c3d7b5b3974a70b09b5a3193b007b9.r2.dev0955134c…—query2026-10-14 11:56
pub-79dff8d8c4974aa0881ab592d7ce9dab.r2.dev0d6987c3…—query2026-10-14 11:56
pub-d9948a178b9c4db5b40246ed5a50881a.r2.dev15d998d5…—query2026-10-14 11:56
pub-af5d7935fe154626a7cf01e7f0f34be2.r2.devcea8c326…—query2026-10-14 11:53
coinbaseverify.vercel.appaf434422…—query2026-10-14 11:52
yogomethed-dpdlu9nkhrlh.edgeone.devd363f43d…—query2026-10-14 11:45
sp12ct-fravkor-biz-kazsel-prondik.pages.dev99ec2f67…—query2026-10-14 08:46
xelfaro-mpt-qazvuni-r7x5me82.pages.dev1af13a49…—query2026-10-14 08:33
tino0908-ecount-dp78obhyuaqp.edgeone.dev3a182adf…—query2026-10-14 07:51
pub-61de878776464004b912696c6c2eb40e.r2.dev7440af7e…—query2026-10-14 06:56
pub-7afa845768fe43dc96640dfb339b567f.r2.dev0c960eb0…—query2026-10-14 06:56
divine-red-oyble4mn-dp1ja9sun0g4.edgeone.dev0817e24d…—query2026-10-14 06:34
pub-c53d218c4f704f2495ca7a15b052e24c.r2.dev7c48eb10…—query2026-10-14 04:55
pub-c83f9fae7dea4ca09fefa3e6ff17706f.r2.dev67f94976…—query2026-10-14 04:55
pub-2cd796e07737407a9447e3735195d740.r2.dev3fc78105…—query2026-10-14 04:55
sp12ct-lorsel-biz-havdek-frensik.pages.dev56123b1a…—query2026-10-14 03:49
berqelo-mpt-zorvani-p1h8me94.pages.dev11999b15…—query2026-10-14 03:49
sp21ct-vemik-biz-noru-lake.pages.devc53b9e5d…—query2026-10-14 03:46
extap1-static.b-cdn.net3403c49a…—query2026-10-14 03:25
mafia-vai-best-premium-hack-dp0wsk7quvnu.edgeone.deva501040a…—query2026-10-14 03:17
burfuro-mpt-qenqali-p5d6ka81.pages.dev869e7ed5…—query2026-10-14 03:06
sp20ct-pelsom-biz-farsik-zelqen.pages.dev706e98fa…—query2026-10-14 02:49
sp33ct-kumeli-biz-faruno-venaki.pages.dev46db432f…—query2026-10-14 02:47
sp21ct-telam-biz-voru-nazi.pages.dev59ea5644…—query2026-10-14 01:49
sp21ct-ravok-biz-zeni-kapu.pages.devc5a846ae…—query2026-10-14 01:48
nervani-kxt-felqora-a4x8fq65.pages.devbecaaabc…—query2026-10-14 01:48
sp12ct-havdok-biz-pronsel-zarmek.pages.dev7f3e203e…—query2026-10-14 01:47
sp10ct10-celvak-biz-vumeko.pages.dev044dc73c…—query2026-10-14 01:47
sp12ct-lersok-biz-prandor-hazvik.pages.dev3f1c7434…—query2026-10-14 01:07
qwbrm02nhwu-mvdcyfyn-4f7g5g-sx222a.pages.dev307e3fce…—query2026-10-14 00:50
bermexa-vrk-belxavi-p9t5fc68.pages.dev5a2d0127…—query2026-10-14 00:46
pub-d27463c25a494efeba2de859778d9bbe.r2.dev02641d2e…—query2026-10-13 23:56
bermexa-vrk-belxavi-p9t5fc68.pages.devae897915…—query2026-10-13 22:09
pub-a28a824001f14aba9fa67e5897db5905.r2.dev5f9289b3…—query2026-10-13 20:53
venfuro-mpt-zanqeli-p7d5ka84.pages.dev22ff74b5…—query2026-10-13 19:42
sp12ct-havdok-biz-pronsel-zarmek.pages.dev25ad7418…—query2026-10-13 18:24
sp15ct-paviko-biz-norev-sulax.pages.dev87cec397…—query2026-10-13 18:20
sp11ct-darnel-biz8-somvik-pralor.pages.devcc71c468…—query2026-10-13 17:54
sp11ct-bravik-biz8-lorpex-vansel.pages.dev46752058…—query2026-10-13 17:54
sp11ct-bravik-biz8-lorpex-vansel.pages.dev9af460bf…—query2026-10-13 17:53
sp11ct-darnel-biz8-somvik-pralor.pages.dev14e6aa8e…—query2026-10-13 17:53
power-booking-gw.pages.devfbc87d7b…—query2026-10-13 16:25
sp11ct-felnor-biz8-tarsik-velmor.pages.dev9e3968ec…—query2026-10-13 15:54
pub-37a2330dcad44f058c9e50a8e9a6532b.r2.dev38cec966…—query2026-10-13 14:54
pub-56bd9143f05d4100b605783bdc43dfff.r2.devfc74905e…—query2026-10-13 14:53
sp11ct-felnor-biz8-tarsik-velmor.pages.dev7cb59a12…—query2026-10-13 14:53
5e4gu-tbr-nwzw-5orrm-28-09-2026-hh.pages.dev5572420f…—query2026-10-13 14:46
a9yx9-aip-fj2t-9qpyc-13-09-2026-hh.pages.dev8aa946ca…—query2026-10-13 14:46
pub-95fa3482339947a7a7e6f858928da971.r2.dev8e249055…—query2026-10-13 13:59
pub-d2a6f607cafa49229bb9c3b680ad79d0.r2.dev4723b691…—query2026-10-13 13:58
pub-ce122c7a4fe542688492dde4f5ccaf25.r2.devbe0554bd…—query2026-10-13 13:53
sp10ct10-ravvek-biz-lumari.pages.dev025eaf9a…—query2026-10-13 13:48
sp1ct10-felval-biz-qavqo-zemri.pages.dev8d7e643f…—query2026-10-13 13:47
paymentsecurelink.vercel.appc264c97d…—query2026-10-13 13:46
live-gold-fg8svnro-dp22wy60yxo6.edgeone.devd33c472f…—query2026-10-13 12:58
sp15ct-selvori-biz-puvan-zemik.pages.dev59d35ed6…—query2026-10-13 12:54
pub-6a3d146cbfec43ec9112d67612054c37.r2.dev16046976…—query2026-10-13 12:53
sp20ct-zorqam-biz-felsik-pronel.pages.dev0de736ec…—query2026-10-13 12:49
yksmv7c93qt-wzprbnnx-6f9e1e-wz990a.pages.dev101b8d49…—query2026-10-13 12:49
c9s74-1xt7ja-e787t-g56vzq.pages.dev6eefe134…—query2026-10-13 12:49
byktp5a34gp-kpnldmja-0k9h6c-byk83c.pages.deva49256e5…—query2026-10-13 12:49
61dns-4to-1vfx-xmmdm-09-10-2026-aa.pages.dev204862b0…—query2026-10-13 12:49