lzrstgg67fe6gf5[.]yewabim168[.]workers[.]dev

PhishDestroy identifies lzrstgg67fe6gf5.yewabim168.workers.dev as a recently spawned domain actively propagating a generic phishing kit designed to harvest user credentials. The threat remains under active investigation, but initial telemetry confirms live traffic to the endpoint and live SSL negotiation via Google Trust Services. Given the absence of detections on VirusTotal and the domain’s cloaking via Cloudflare Workers, the actor is leveraging legitimate infrastructure to evade detection while deploying a simple yet effective obfuscation layer. This presents a moderate-to-high risk to organisations whose employees may encounter the lure via email, social media, or spoofed landing pages.

This domain was flagged with a risk level of under_investigation yet remains flagged as active by PhishDestroy telemetry. The infrastructure resolves to IP 104.21.36.119—hosted on Cloudflare’s edge network—and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, granting the kit an air of legitimacy. VirusTotal analysis shows 0 detections out of 95 engines as of the last scan. The seed identifier 6fe4a5 confirms the domain’s membership in a rotating campaign cluster known to target corporate login portals. Additional telemetry indicates no prior inclusion on public blocklists at the time of assessment; however, the campaign’s recent inception and rapid endpoint churn suggest imminent expansion into anti-phishing feeds.

Mitigation requires immediate network-level action. Organisations should add the domain and its resolving IP to DNS and firewall blocklists using exact match rules to prevent outbound resolution or inbound redirection. Security mail gateways should be updated with a custom rule to quarantine any email containing the domain or its seeded subdomain pattern, using the seed 6fe4a5 as a regex anchor to catch derivations. User awareness training should emphasize verifying destination domains before credential entry, especially when links arrive via unsolicited channels. Lastly, TLS inspection should monitor outbound traffic to 104.21.36.119 for POST requests to non-standard endpoints, as the kit is likely configured to exfiltrate credentials to a secondary domain or IP not yet observed. Continuous hunting for new subdomains under yewabim168.workers.dev is recommended to stay ahead of this agile adversary.