hemat138[.]mamamudah559[.]workers[.]dev

PhishDestroy identifies hemat138.mamamudah559.workers.dev as an active phishing domain impersonating a login portal, likely targeting credential theft. This Workers.dev subdomain resolves to IP 188.114.96.3 and leverages a Google Trust Services SSL certificate to appear legitimate. The domain currently shows zero detections on VirusTotal (1/95 engines), suggesting it evades traditional antivirus tools but remains under investigation by security researchers. Registered through Cloudflare, Inc., the domain’s Workers.dev platform association further complicates tracking due to Cloudflare’s masking of underlying infrastructure. This domain exhibits clear phishing indicators, including a deceptive Workers.dev subdomain (mamamudah559) designed to mimic a trusted service. The combination of a Google-issued SSL certificate and Cloudflare’s infrastructure adds a veneer of authenticity, tricking users into entering sensitive credentials. With no current blocklist detections, the threat remains undetected by most security tools, increasing the risk of successful phishing campaigns. The seed identifier 6dd2d1 suggests this is part of a larger, evolving campaign. Users who visited hemat138.mamamudah559.workers.dev should immediately check their browser history for unauthorized logins and revoke any exposed credentials. If credentials were entered, change passwords on all accounts using the same login details and enable multi-factor authentication where possible. Report the domain to your IT administrator or security team and avoid interacting with similar Workers.dev subdomains. Use a reputable ad-blocker or DNS filtering service to block known malicious domains proactively.