# PhishDestroy threat dossier — workplace-safety-analyzer.pages.dev ================================================================ Fetched: 2026-07-03 06:21:57 UTC Canonical: https://phishdestroy.io/domain/workplace-safety-analyzer.pages.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 88/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Public blocklists: listed on 1 independent blocklist ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.66.44.60 (US, San Francisco) ASN: ASAS13335 CLOUDFLARENET - Cloudflare, Inc., US Hosting org: AS13335 Cloudflare, Inc. Registrar: Cloudflare, Inc. Nameservers: duke.ns.cloudflare.com, kara.ns.cloudflare.com Page title: Workplace Safety Risk Analyzer | SafetyNet AI by Apprend HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-09-19 Status: INVALID chain Fingerprint: bd158211d57b7db74d47e25592138f299b8c3f767900388301e40a4ce80923a8 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-06-21 21:06:11 UTC (by PhishDestroy tracker) Last verified: 2026-07-03 08:20:35 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019eeb92-9e06-728c-b9ee-1df96e74724d/ Wayback Machine: https://web.archive.org/web/*/workplace-safety-analyzer.pages.dev crt.sh CT logs: https://crt.sh/?q=%25.workplace-safety-analyzer.pages.dev Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=workplace-safety-analyzer.pages.dev AlienVault OTX: https://otx.alienvault.com/indicator/domain/workplace-safety-analyzer.pages.dev URLhaus: https://urlhaus.abuse.ch/host/workplace-safety-analyzer.pages.dev/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-25 19:30:52 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, workplace-safety-analyzer.pages.dev, is under investigation for brand impersonation phishing targeting workplace safety assessment platforms. The page presents itself as a legitimate workplace safety risk analyzer under the fabricated brand 'SafetyNet AI by Apprend,' mimicking corporate safety evaluation tools. Analysis indicates no direct association with known drainer kits or credential harvesters, but the domain exhibits characteristics consistent with brand impersonation to establish credibility for potential social engineering or data collection campaigns. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.66.44.60, hosted on Cloudflare’s network (AS13335). It is registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services (WE1). VirusTotal detection rate stands at 0/95, indicating no current antivirus flags, while Google Safe Browsing status remains unlisted. The domain appears on one security blocklist (PhishDestroy) and presents a page title of 'Workplace Safety Risk Analyzer | SafetyNet AI by Apprend.' No historical WHOIS data is available due to Cloudflare’s privacy protections, limiting creation date visibility. Current status remains active, with no takedown or suspension observed. The domain continues to resolve and serve content, posing a persistent risk of brand deception. Response actions should include monitoring for credential harvesting scripts, user data submission forms, or secondary payload delivery. Organizations are advised to block the domain at the network level and alert employees to the impersonation risk. Given the zero detection rate on VirusTotal, reliance on traditional antivirus signatures may be insufficient; behavioral analysis and endpoint monitoring are recommended for comprehensive protection. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: a9aa75cd8880bb79a8b83ec380ea7104 TLS cert SHA-256: bd158211d57b7db74d47e25592138f299b8c3f767900388301e40a4ce80923a8 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/workplace-safety-analyzer.pages.dev/ JSON API: https://api.destroy.tools/v1/check?domain=workplace-safety-analyzer.pages.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 174,154 domains (13,613 alive under monitoring, 159,748 confirmed takedowns/dead). Site: https://phishdestroy.io