# PhishDestroy domain threat record: 01kz4kz0hfaqkfyzbpjc8efzzw.cfworking.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/01kz4kz0hfaqkfyzbpjc8efzzw.cfworking.com/ Machine-readable companion: https://phishdestroy.io/domain/01kz4kz0hfaqkfyzbpjc8efzzw.cfworking.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-08-05 16:40:10 UTC - Last availability or vendor check: 2026-10-25 02:00:43 UTC - Stored record updated: 2026-10-25 03:20:37 UTC - VirusTotal detections in the stored snapshot: 2/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Registrar in stored WHOIS data: Realtime Register B.V. - Registrar country in stored WHOIS data: NL - Registration date (registry RDAP, cfworking.com): 2026-07-30 14:35:19 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/01kz4kz0hfaqkfyzbpjc8efzzw.cfworking.com - Certificate Transparency search: https://crt.sh/?q=%25.01kz4kz0hfaqkfyzbpjc8efzzw.cfworking.com - Web Archive lookup: https://web.archive.org/web/*/https://01kz4kz0hfaqkfyzbpjc8efzzw.cfworking.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview 01kz4kz0hfaqkfyzbpjc8efzzw.cfworking.com is a domain on the PhishDestroy blocklist. It is a long, random-looking subdomain under cfworking.com, and no brand or page title has been tied to it. PhishDestroy first saw it on 2026-08-05. The site has been offline since 2026-09-13, and its DNS was still inactive at the last check on 2026-10-19. How the scam works No specific scheme has been confirmed for this host, so we do not attribute it to any particular brand, kit or drainer. Hosts like this usually live for a short time and reach visitors through links in messages, ads or social posts rather than through search. The flags against it point to the usual risks of a malicious page: a fake login or wallet prompt that collects credentials or seed phrases, or a page that pushes visitors to approve something they did not intend. Anyone who reached it from an unsolicited link should treat whatever they entered or approved there as exposed. Evidence On 2026-09-13, two of 89 VirusTotal engines flagged the domain: Forcepoint ThreatSeeker and SOCRadar. That is a thin result, and the domain went offline the same day, so most vendors had little chance to analyse it. The listing rests mainly on PhishDestroy's own blocklist entry, backed by those two independent vendor verdicts. Infrastructure The parent domain cfworking.com is registered through Realtime Register B.V. The randomized, 26-character label suggests a generated subdomain rather than a name chosen for people to remember, and generated names make individual hosts easy to rotate and discard. The host stopped resolving about five weeks after PhishDestroy first saw it. What to do If you visited this host and typed a password, change it everywhere you reuse it and turn on two-factor authentication. If you entered a recovery phrase, move your funds to a new wallet right away. If you connected a wallet or signed anything, review and revoke unfamiliar token approvals. Defenders should block cfworking.com subdomains matching this random pattern at DNS and proxy level, and search logs for traffic to this host from 2026-08-05 onward. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/01kz4kz0hfaqkfyzbpjc8efzzw.cfworking.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=01kz4kz0hfaqkfyzbpjc8efzzw.cfworking.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:55:09 UTC ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-21T02:31:04Z", "uuid": "26e417aa-98d6-4871-9e5d-5362d56814ce", "scanned_at": "2026-09-12T22:34:06Z" }, "vt": { "v": 1, "fetched_at": "2026-10-22T14:54:58Z", "analysis_at": "2026-10-18T21:06:06Z", "stats": { "timeout": 0, "harmless": 52, "malicious": 4, "suspicious": 0, "undetected": 36 }, "detections": { "CRDF": "malicious", "SOCRadar": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "categories": { "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)" }, "registrar": "Realtime Register B.V.", "created": "2026-07-30T14:35:19Z", "expires": "2027-07-30T14:35:19Z", "updated": "2026-09-28T14:35:56Z", "first_seen": "2026-08-05T17:41:09Z", "dns": [ { "ttl": 600, "type": "A", "value": "104.237.144.193" } ], "dns_at": "2026-08-05T17:50:17Z", "jarm": "27d40d40d00040d00042d43d000000e1ea2a807a629b496b664cf07ad7c08d", "cert": { "san": [ "*.cfworking.com" ], "issuer": "Let's Encrypt / YE1", "serial": "6b96bdd0c69b2d4c900fce70b30d4f3743b", "sha256": "b5552f7162d97e563b8a33df20528e2d550d86dff0ffaa72ea0f547fc4a5f2ee", "subject": "*.cfworking.com", "valid_to": "2026-10-28T13:42:16Z", "valid_from": "2026-07-30T13:42:17Z" }, "whois": { "registrar": "Realtime Register B.V.", "registrar_iana_id": "839", "registrar_url": "http://www.realtimeregister.com", "created": "2026-07-30T14:35:19Z", "updated": "2026-09-28T14:35:56Z", "expires": "2027-07-30T14:35:19Z", "status": [ "clientHold" ], "nameservers": [ "poppy.ns.cloudflare.com", "zac.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```