cbse7623jhasdj[.]riki83[.]workers[.]dev

The domain cbse7623jhasdj.riki83.workers.dev was observed delivering a brand‑impersonation payload targeting Google, as indicated by the page title "Google" and the listed scam type. The site was registered through Cloudflare, Inc., and the infrastructure resolves to the IP address 142.250.186.164, which belongs to AS15169 Google LLC and is physically located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 designation, matching the IP’s ownership but not confirming legitimate affiliation with Google’s services. HTTP requests to the host return a 403 status code, and the service advertises HSTS, Cloudflare, and HTTP/3 support, consistent with a hardened hosting configuration.

Detection services have flagged the domain: thirteen of ninety‑five VirusTotal scanners reported malicious behavior, and Gridinsoft assigned a trust score of zero out of one hundred. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed. The current operational status is offline, and no nameserver records were returned, suggesting the domain may have been taken down or is in the process of being decommissioned.

Defenders should treat this indicator as high confidence evidence of a Google‑impersonation campaign. Immediate actions include adding the fully qualified domain name to URL filtering and DNS block lists, ensuring that any automated web‑content filters reference the latest blocklist entries, and monitoring for related subdomains or similarly structured workers.dev URLs. Although the site is presently offline, its association with Cloudflare’s edge network and the use of a legitimate Google‑owned IP underscore the need for continued vigilance. Continuous re‑scanning of the domain by threat‑intel platforms is advisable to capture any re‑activation or changes in hosting.