ldgrhd3453453jsd[.]shreyansh40[.]workers[.]dev

The domain ldgrhd3453453jsd.shreyansh40.workers.dev is a confirmed phishing site engaged in brand impersonation targeting Google. It presents itself as a legitimate Google login page to deceive users into entering sensitive credentials, posing an elevated risk of credential theft. No crypto drainer kit was detected. The site is currently taken offline, but prior activity indicates it was actively used for phishing scams.

Technical analysis of ldgrhd3453453jsd.shreyansh40.workers.dev reveals limited detection, with 1 of 95 VirusTotal security vendors flagging it as malicious, including Fortinet. The domain is registered through Cloudflare, Inc., and resolves to the IP address 142.250.184.196, hosted on Google LLC's infrastructure in the US. It appears on 1 security blocklist, specifically PhishDestroy. The SSL certificate is issued by Google Trust Services / WE1, and the observed page title was 'Google'. Technologies detected include HSTS, Cloudflare, and HTTP/3, with the site returning an HTTP 403 status at the time of assessment.

Users who may have interacted with ldgrhd3453453jsd.shreyansh40.workers.dev should immediately change their Google account passwords and enable two-factor authentication to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google’s Safe Browsing team via their reporting tool and to the Anti-Phishing Working Group at reportphishing@apwg.org. If credentials were entered, assume they are compromised and avoid reusing them across other services.