ldgrhd3453453jsd[.]clara65[.]workers[.]dev

The domain ldgrhd3453453jsd.clara65.workers.dev is a generic phishing site designed to steal user credentials through credential phishing. It does not impersonate a specific brand or use a known drainer kit. The site is currently taken offline, but it previously posed an elevated risk to visitors by attempting to harvest login information through deceptive means.

Technical analysis shows that ldgrhd3453453jsd.clara65.workers.dev was flagged by 1 of 95 VirusTotal security vendors, including Trustwave. It was registered through Cloudflare, Inc. on February 21, 2026, and resolved to the IP address 172.67.148.73, hosted by Cloudflare in the US. The domain appeared on 1 security blocklist (PhishDestroy) and used an SSL certificate issued by Google Trust Services (WE1). The observed page title was 'Suspected phishing site | Cloudflare,' and it returned an HTTP 403 status. Technologies detected included HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100.

Users who may have interacted with ldgrhd3453453jsd.clara65.workers.dev should immediately change passwords for any accounts accessed during the exposure period. Enable two-factor authentication (2FA) on all critical services to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google Safe Browsing, the Anti-Phishing Working Group (APWG), and local cybersecurity authorities to aid in mitigation efforts.