Phishing detection: vint.yjiankuny.workers.dev

Google
https://vint.yjiankuny.workers.dev/auth/google/oauth?redirect_uri=%2Fmember%2Fsignup%2Fselect_type Access site
Screenshot
Screenshot of vint.yjiankuny.workers.dev
Investigate
Domain vint.yjiankuny.workers.dev6 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 104.21.10.181
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://vint.yjiankuny.workers.dev/auth/google/oauth?redire…
urlscan Wayback archive.today
Cert WE1
crt.sh Censys Google CT
Phishunt analysis Beta
23 low suspicionheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +5.1 Site cluster
  • +4.1 Brand in screenshot
  • +3.0 OpenPhish
  • +2.0 Young domain
  • +1.1 ASN reputation
  • +0.6 Brand impersonation in path
  • +0.6 Login text in screenshot
  • +0.6 Suspicious TLD
  • +0.5 Long domain
  • +0.3 Free CA
  • +0.3 Deep subdomain
14 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

A Cloudflare Workers-hosted page mimicking a Google OAuth sign-in flow with a signup redirect. The brand does not match the host, the page links out to the brand, and OpenPhish lists it, indicating Google account credential harvesting.

Brand impersonation in pathOpenPhishPaaS host
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-24 · confidence 72%
Domain & Network
Whois
Registrar CloudFlare, Inc.
Network
IP 104.21.10.181 Cloudflare CDN
Country United StatesUnited States
Hosting Cloudflare, Inc.
ASN AS13335
TLS Cert WE1
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Report this phishing
PaaS platform Cloudflare Workers
Web form
Registrar CloudFlare, Inc.
registrar-abuse@cloudflare.com
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-10-24 01:02 UTC  ·  Last refreshed 2026-10-24 11:30 UTC