# Cloudflare Workers — PhishDestroy Threat Report Source: https://phishdestroy.io/domain/?registrar=Cloudflare+Workers Generated: 2026-06-30T12:22:58+00:00 ## Threat statistics - Flagged phishing domains in PhishDestroy DB: 109 - Still alive (not yet taken down): 65 (59.6%) - Taken down: 43 - VirusTotal-detected: 99 (90.8% detection rate) - Avg VT detections (non-zero): 11.6 - High-confidence threats (VT ≥ 5): 87 - First flagged: 2025-09-10 06:25:50 - Last flagged: 2026-06-14 18:08:38 ## Sample flagged domains (top 50 by VT detections) - hea-law-4dd5b558f3fa5044.denavif883-d3e1.workers.dev [VT:22, status:dead] → https://phishdestroy.io/domain/hea-law-4dd5b558f3fa5044.denavif883-d3e1.workers.dev/ - index-ap3.tyler2miler-proton-me-s-account.workers.dev [VT:20, status:dead] → https://phishdestroy.io/domain/index-ap3.tyler2miler-proton-me-s-account.workers.dev/ - webapp-getdocumentodwnload-pacapp.malik-jaani786.workers.dev [VT:20, status:alive] → https://phishdestroy.io/domain/webapp-getdocumentodwnload-pacapp.malik-jaani786.workers.dev/ - auth-office-device-com.dporozok.workers.dev [VT:19, status:dead] → https://phishdestroy.io/domain/auth-office-device-com.dporozok.workers.dev/ - join-eligible-ede8.oppome7272.workers.dev [VT:19, status:dead] → https://phishdestroy.io/domain/join-eligible-ede8.oppome7272.workers.dev/ - office-docusign-net.tammy-e82.workers.dev [VT:19, status:dead] → https://phishdestroy.io/domain/office-docusign-net.tammy-e82.workers.dev/ - accessportal-myvalidcredentials.buddyl.workers.dev [VT:18, status:dead] → https://phishdestroy.io/domain/accessportal-myvalidcredentials.buddyl.workers.dev/ - mrtm-ywoc-dm31.rdials-compasslabservices-com-s-account.workers.dev [VT:18, status:dead] → https://phishdestroy.io/domain/mrtm-ywoc-dm31.rdials-compasslabservices-com-s-account.workers.dev/ - t9jz-rz7w-mzfi.rsadler.workers.dev [VT:18, status:dead] → https://phishdestroy.io/domain/t9jz-rz7w-mzfi.rsadler.workers.dev/ - adobe-4s9.kpenza-htrenchless-com-s-account.workers.dev [VT:17, status:alive] → https://phishdestroy.io/domain/adobe-4s9.kpenza-htrenchless-com-s-account.workers.dev/ - adobe-t9r.thomas-gibson-clyde-enq-com-s-account.workers.dev [VT:17, status:dead] → https://phishdestroy.io/domain/adobe-t9r.thomas-gibson-clyde-enq-com-s-account.workers.dev/ - auth-login-office-com.saxeco7653.workers.dev [VT:17, status:dead] → https://phishdestroy.io/domain/auth-login-office-com.saxeco7653.workers.dev/ - e5xg-awkv-qdpy.debby-woods-texels.workers.dev [VT:17, status:dead] → https://phishdestroy.io/domain/e5xg-awkv-qdpy.debby-woods-texels.workers.dev/ - iejy-8qbo-izql.ddurham-millers-is-com-s-account.workers.dev [VT:17, status:dead] → https://phishdestroy.io/domain/iejy-8qbo-izql.ddurham-millers-is-com-s-account.workers.dev/ - index-4eo.dianna-mudmedia-co-nz-s-account.workers.dev [VT:17, status:alive] → https://phishdestroy.io/domain/index-4eo.dianna-mudmedia-co-nz-s-account.workers.dev/ - index-aj9.michelleteh-surgipro-com-sg-s-account.workers.dev [VT:17, status:alive] → https://phishdestroy.io/domain/index-aj9.michelleteh-surgipro-com-sg-s-account.workers.dev/ - ldgrinyhgj.azalea1.workers.dev [VT:17, status:dead] → https://phishdestroy.io/domain/ldgrinyhgj.azalea1.workers.dev/ - voice-mail-office-auth-device.dporozok.workers.dev [VT:17, status:dead] → https://phishdestroy.io/domain/voice-mail-office-auth-device.dporozok.workers.dev/ - adobe-ael.saliphaberylin.workers.dev [VT:16, status:alive] → https://phishdestroy.io/domain/adobe-ael.saliphaberylin.workers.dev/ - adobe-xaf.azavier-cavion-dropons-com-s-account.workers.dev [VT:16, status:alive] → https://phishdestroy.io/domain/adobe-xaf.azavier-cavion-dropons-com-s-account.workers.dev/ - docusign-1vk.export-cellular-iberia-com-s-account.workers.dev [VT:16, status:alive] → https://phishdestroy.io/domain/docusign-1vk.export-cellular-iberia-com-s-account.workers.dev/ - docusign-8pt.shawn-knowler-smcalgarys-com-s-account.workers.dev [VT:16, status:alive] → https://phishdestroy.io/domain/docusign-8pt.shawn-knowler-smcalgarys-com-s-account.workers.dev/ - docusign-ghj.christina-parsons-charter-comm-com-s-account.workers.dev [VT:16, status:alive] → https://phishdestroy.io/domain/docusign-ghj.christina-parsons-charter-comm-com-s-account.workers.dev/ - index-546.hank-andrews-verusresearchs-net-s-account.workers.dev [VT:16, status:alive] → https://phishdestroy.io/domain/index-546.hank-andrews-verusresearchs-net-s-account.workers.dev/ - index-r78.jcoan-marcusfoodsco-com-s-account.workers.dev [VT:16, status:dead] → https://phishdestroy.io/domain/index-r78.jcoan-marcusfoodsco-com-s-account.workers.dev/ - nhgo-2xnx-cw12.jennifer-jencrosslaw-com-s-account.workers.dev [VT:16, status:cloaking] → https://phishdestroy.io/domain/nhgo-2xnx-cw12.jennifer-jencrosslaw-com-s-account.workers.dev/ - office-document-sign.tammy-e82.workers.dev [VT:16, status:dead] → https://phishdestroy.io/domain/office-document-sign.tammy-e82.workers.dev/ - rx03-qe8k-40xp.tom-macsystemsltd-co-uk-s-account.workers.dev [VT:16, status:dead] → https://phishdestroy.io/domain/rx03-qe8k-40xp.tom-macsystemsltd-co-uk-s-account.workers.dev/ - cr.rwks0876.workers.dev [VT:15, status:alive] → https://phishdestroy.io/domain/cr.rwks0876.workers.dev/ - dl1x-o87f-nmf7.julio-moisa-emitpa-biz-s-account.workers.dev [VT:15, status:dead] → https://phishdestroy.io/domain/dl1x-o87f-nmf7.julio-moisa-emitpa-biz-s-account.workers.dev/ - shy-grass-1585.itsvarexykvvphaawcayyow.workers.dev [VT:15, status:alive] → https://phishdestroy.io/domain/shy-grass-1585.itsvarexykvvphaawcayyow.workers.dev/ - silent-dust-b567.elymatldielwa4741.workers.dev [VT:15, status:dead] → https://phishdestroy.io/domain/silent-dust-b567.elymatldielwa4741.workers.dev/ - vh2d-5gym-fzwk.mqpor-metroquip-us-s-account.workers.dev [VT:15, status:alive] → https://phishdestroy.io/domain/vh2d-5gym-fzwk.mqpor-metroquip-us-s-account.workers.dev/ - adobe-pss.chad-pureswinggolf-com-s-account.workers.dev [VT:14, status:dead] → https://phishdestroy.io/domain/adobe-pss.chad-pureswinggolf-com-s-account.workers.dev/ - adobe-t6u.kira-schneider-sanjunranchtx-com-s-account.workers.dev [VT:14, status:dead] → https://phishdestroy.io/domain/adobe-t6u.kira-schneider-sanjunranchtx-com-s-account.workers.dev/ - data-form-f5at.p-lvqyivvk.workers.dev [VT:14, status:alive] → https://phishdestroy.io/domain/data-form-f5at.p-lvqyivvk.workers.dev/ - docusign-dj2.gihida6940-ostahie-com-s-account.workers.dev [VT:14, status:alive] → https://phishdestroy.io/domain/docusign-dj2.gihida6940-ostahie-com-s-account.workers.dev/ - executioncopy-7f6.vpuri-outpastmgt-com-s-account.workers.dev [VT:14, status:alive] → https://phishdestroy.io/domain/executioncopy-7f6.vpuri-outpastmgt-com-s-account.workers.dev/ - o5lz-1oxd-aqvn.julio-moisa-emitpa-biz-s-account.workers.dev [VT:14, status:alive] → https://phishdestroy.io/domain/o5lz-1oxd-aqvn.julio-moisa-emitpa-biz-s-account.workers.dev/ - sharepoint-3ni.sandhiprakash-bhide-nanusens-com-s-account.workers.dev [VT:14, status:alive] → https://phishdestroy.io/domain/sharepoint-3ni.sandhiprakash-bhide-nanusens-com-s-account.workers.dev/ - voice-mail-auth-office-com.saxeco7653.workers.dev [VT:14, status:dead] → https://phishdestroy.io/domain/voice-mail-auth-office-com.saxeco7653.workers.dev/ - voicemail-59f.admin-treyripple-com-s-account.workers.dev [VT:14, status:alive] → https://phishdestroy.io/domain/voicemail-59f.admin-treyripple-com-s-account.workers.dev/ - dpuqq-anbp-t8kh.c-1o2k0n4w.workers.dev [VT:13, status:alive] → https://phishdestroy.io/domain/dpuqq-anbp-t8kh.c-1o2k0n4w.workers.dev/ - lj4y-lxqc-ukfw.erik-cintive-com-s-account.workers.dev [VT:13, status:alive] → https://phishdestroy.io/domain/lj4y-lxqc-ukfw.erik-cintive-com-s-account.workers.dev/ - odd-dew-3b41.gilbertallan7734.workers.dev [VT:13, status:dead] → https://phishdestroy.io/domain/odd-dew-3b41.gilbertallan7734.workers.dev/ - p84v-4cdn-twbk.dgardner-allergyasthmanetwork-org-s-account.workers.dev [VT:13, status:alive] → https://phishdestroy.io/domain/p84v-4cdn-twbk.dgardner-allergyasthmanetwork-org-s-account.workers.dev/ - quiet.rwks332.workers.dev [VT:13, status:alive] → https://phishdestroy.io/domain/quiet.rwks332.workers.dev/ - raspy-limit-2bfe.bkecylytntreimdilhdldvo.workers.dev [VT:13, status:alive] → https://phishdestroy.io/domain/raspy-limit-2bfe.bkecylytntreimdilhdldvo.workers.dev/ - solitary-hill-38dc.rnxarixixmnogrnvegaoitc.workers.dev [VT:13, status:alive] → https://phishdestroy.io/domain/solitary-hill-38dc.rnxarixixmnogrnvegaoitc.workers.dev/ - vgpa-4zqa-zz1h.lucianna-info2.workers.dev [VT:13, status:alive] → https://phishdestroy.io/domain/vgpa-4zqa-zz1h.lucianna-info2.workers.dev/ ## Links - Full interactive hub: https://phishdestroy.io/domain/?registrar=Cloudflare+Workers - Site-wide LLM feed: https://phishdestroy.io/llms.txt - Report abuse / appeals: https://phishdestroy.io/appeals/