Indicator of Compromise
workers[.]dev
A domain observed in malicious infrastructure. Block or monitor it in DNS and web proxies. Shown defanged for safe viewing; use Copy live value for the functional form.
Included in theDomains feed(live, machine-readable).
Seen in these reports
Cyber Security Blog·Jul 1, 2026
ARToken Shows Microsoft 365 Tokens Are the New BEC Control Plane
Cyber Security Blog·May 16, 2026
Device Code Phishing Turns Legitimate Login Flows Into Token Theft
Chinese Cyber Threat Intelligence·Mar 3, 2026
Silver Dragon APT Targets Southeast Asia and Europe Using GearDoor Backdoor with Google Drive C2
Related indicators
Indicators that appear alongside this one in the same reporting, often shared infrastructure or the same campaign.
019d442a-endpoint[.]com019d442e-endpoint[.]com019d6860-endpoint[.]com0fdba029e6a5-endpoint[.]com104[.]21[.]51[.]8166e777cb72a7c4e126f8ed97e0a82e7ca9e87df7793fea811daf34e1e7e47a616b9a7358be88632378ba20ba1430786f3b844694b1f876211ecdbecf5cccbc219139a525ee9c22efd6a4842c4cd50ab2c5f9ee391e5531071df0bb4e685f55d2dc62559e005-endpoint[.]com2f787c1454891b242ab221b8b8b420373c3eb1a0c1fdcb624dd800c50758bbb03128bdb8efaaa04c0ba96337252f4cc2dc795021cbc410f74ace9dde958bac1d37b485ed8d150d022c41e5e307b8c54c34ef806625b44d0c940b18be7d5b29ce3a2df7a2cfeca5ba315a29cf313268a53a22316c925e6b9760ead8f4df0d1f753e2a0bafbd44e24b17fd7b17c9f2b2a3727349971d42612d55bbc1732082619a43f8f94ca5aa0af7bfb0cc1d2f664a46500a161b2d082b48b516d084ef48534844e769efed3e4f9f04c52dcd13f15cead251a1a08827a2cb6ea68427522c7fbb4daa2aea93db-endpoint[.]com4f93be0c46a53701b1777ab8df874c837df3d8256e026f138d60fc2932e569a851684a0e356513486489986f5832c948107ff687c8501d64846cdc43074294135341c7256542405abdd01ee288b08e49dcb6d1782be6b7bea63b459d80f9a8f5568c67564d62b09d1a1bc29a494cf4bf31afddcafcf78592b178c63f23ccfcae5ad857df8976523cb3ad2fdf30e87c0e7daa64135716b139ffdcd209b98e16546dd5fd945b34-endpoint[.]com72e4b6540e32b8b7aac850055609bc5afc19e29834e9aa6be29a8ea59a2c97857384462d420bdc9683a4cac2a8ad19353a2aa7d2244c91e9182345777e811e33740a09fcdefa5a5f79355b720f54ff09efa64062229fb388adbccd9c829e9ff074a11a07d167f8f5c0baa724d1f7708985c81d0ac3d0e4d7ef3f3220c335e0097740f766-8d1d-46ad-a6bc-onedrive[.]p-9jluifuu[.]workers[.]dev7806d4cf9366-endpoint[.]com7f89a4d5af47bc00a9ad58f0bcbe8a7be2662953dcd03f0e881cc5cbf6b7bca885a03d2e74ae84093a74699057693d11e5c61f85b62e741778cbc5fc9f89022f8c29f9189a9ad75a959024f59e68c62d42a6fd42f9eacf847128c7efe4ef7578948468aba5c851952ebe56a5bf37904ed83a6c8cb520304db6938d79892f0a1b967b5c611d304385807ea2d865fa561c15cde0473dd63e768679a4f29f0e45639d3f61dcaba90db2ede1c1906a80ace2a6b5448ba45f3f352f5f4c5376024891adda1ef8ebf62a8fe63424fa230c691dampolice[.]orgaudit-report-9767d3[.]fullerjp09[.]workers[.]devb93560c4d18120e113fb8b04a8aa05f66a12116d1fbf18a93186f6314381e97ebcbe2f0a8134c0e7fce18d0394ababc1d910e6f7b77b8c07643434cd14f4c5d6