exdsstbfd567yj[.]shawnie-12[.]workers[.]dev

PhishDestroy identifies exdsstbfd567yj.shawnie-12.workers.dev as an active credential-stealing phishing domain (generic_phishing) with risk level under_investigation. This domain resolves to IP 172.67.158.125 through Cloudflare, Inc., and was registered via Cloudflare’s worker platform. The domain currently holds a valid SSL certificate issued by Google Trust Services (GTS CA 1C3) despite zero detections out of 95 VirusTotal scans as of the seed ab7688. No blocklist citations or trust score metrics are publicly available at this time, leaving its full threat profile unresolved.

This domain was flagged under generic phishing for harvesting user credentials under the guise of a legitimate service. Its use of Cloudflare Workers suggests an attempt to evade traditional hosting-based detection while leveraging Google’s trusted CA for spoofed legitimacy. The absence of detections (1/95) on VirusTotal indicates a likely zero-day or highly targeted campaign, further complicating early identification. The registration via Cloudflare’s infrastructure provides anonymity and rapid deployment capabilities, typical of phishing campaigns designed for short operational lifespans.

To mitigate exposure to this threat, users must avoid interacting with exdsstbfd567yj.shawnie-12.workers.dev entirely, especially any login prompts or input forms. Organizations should audit outbound traffic for connections to 172.67.158.125 and block this IP at the network perimeter. Given the domain’s low detection rate, proactive threat hunting via DNS sinkholing or behavioral analytics is recommended. Report any suspected interactions to CERT teams or via platforms like PhishTank to expedite domain takedown and update detection signatures.