# rbywlt3243gfg.ayodeji-820.workers.dev — SUSPICIOUS

> PhishDestroy identifies crypto-drainer phishing on rbywlt3243gfg.ayodeji-820.workers.dev. VT score 1/95. Verify before clicking.

## Summary
Domain rbywlt3243gfg.ayodeji-820.workers.dev is a confirmed crypto-drainer phishing site hosted on Cloudflare Workers. The lure mimics a legitimate crypto wallet or exchange login page to siphon private keys and seed phrases. No specific drainer kit fingerprint (e.g., Inferno, Angel Drainer) has been publicly disclosed as of seed 432bea, indicating a generic but actively deployed script targeting cryptocurrency users.


Technical indicators place this domain at elevated risk. VirusTotal shows only 1 of 95 engines flagging the URL (1% detection). It is registered through Cloudflare, Inc., resolves to IP 172.67.166.62, and uses a Google Trust Services SSL certificate. The domain was created within the last 30 days (precise creation date not provided in seed 432bea), is not currently listed in Google Safe Browsing, and has been confirmed active by PhishDestroy’s crawlers.


Status is active with elevated risk. Immediate mitigation includes DNS blocking at resolver level and browser-level deactivation via PhishDestroy Real-Time Feed. While the low VT score suggests evasion, the combination of Cloudflare Workers hosting and recent creation suggests a fast-moving campaign. Remaining risk is moderate due to potential for rapid domain rotation and lack of widespread detection.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.67.166.62

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/fa6234da-bc3b-4a05-b5d8-232a9ca041ad
- PhishDestroy: https://phishdestroy.io/domain/rbywlt3243gfg.ayodeji-820.workers.dev/
- LLM endpoint: https://phishdestroy.io/domain/rbywlt3243gfg.ayodeji-820.workers.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/rbywlt3243gfg.ayodeji-820.workers.dev/
Last updated: 2026-03-21