indicatorurl
hxxps://stored-plans-hlei[.]w-y9a826[.]workers[.]dev/
- First seen
- 2026-08-12
- Last seen
- 2026-08-12
- Sightings
- 1
Posts referencing this indicator
- The Infrastructure Relay: Inside Multi-Stage Phishing Redirection Chains
Cloudflare Workers-hosted second stage presenting a fake CAPTCHA and assembling the final Google sign-in phishing page via Blob API