exdsstbfdgt4[.]sad87dfs[.]workers[.]dev

This domain, exdsstbfdgt4.sad87dfs.workers.dev, poses a high-risk brand impersonation threat specifically targeting Gmail users. The site replicates the Google login interface, including the page title 'Google' and an SSL certificate issued by Google Trust Services (WE1), to deceive visitors into entering their credentials. The objective is credential theft, enabling unauthorized access to victims' email accounts, which may lead to further compromise of linked services, data exfiltration, or lateral movement within corporate environments. Analysis of the domain reveals multiple technical indicators supporting its malicious classification. The domain was registered on February 21, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.97.3, hosted on Cloudflare's infrastructure (AS13335). VirusTotal reports that 10 out of 95 security vendors flag this domain as malicious, while it appears on at least one security blocklist. The SSL certificate, while issued by a legitimate provider, is being misused to lend an air of authenticity to the fraudulent site. The use of a workers.dev subdomain further complicates attribution and takedown efforts due to Cloudflare's distributed infrastructure. Users who have visited exdsstbfdgt4.sad87dfs.workers.dev or entered credentials on the site should take immediate remedial action. First, revoke access to any sessions or applications linked to the compromised Gmail account. Reset the account password using a secure device and enable multi-factor authentication if not already active. Monitor the account for unauthorized activity, such as sent emails, forwarding rules, or connected third-party applications. Additionally, scan the device used to access the site for malware, as credential theft sites may deploy additional payloads. Report the incident to the targeted brand's security team and consider notifying relevant data protection authorities if sensitive information was exposed.