xfvhg-pmsm-npe5[.]p-mv4ac1tf[.]workers[.]dev

PhishDestroy has identified xfvhg-pmsm-npe5.p-mv4ac1tf.workers.dev as a high-risk generic phishing domain currently active. The domain was created on May 19, 2026, and appears to be used for credential theft or other phishing purposes, though no specific brand impersonation or drainer kit has been confirmed at this time. The site's page title is simply "Loading...", which is a common tactic to evade detection while hosting malicious content.

Technical indicators paint a clear picture of risk: VirusTotal flags this domain with 16 out of 95 security vendors marking it as malicious. The domain is registered through Cloudflare, Inc., and its SSL certificate is issued by Let's Encrypt (E7). It resolves to IP address 104.21.20.195. Google Safe Browsing status is not explicitly provided, but the domain appears on 1 security blocklist, further corroborating its malicious nature.

As of now, the domain remains active and has not been taken down. PhishDestroy recommends that users avoid interacting with this domain entirely and verify any suspicious links through PhishDestroy's checking tools. The primary risk is credential theft or installation of malware if users are tricked into entering sensitive information. Organizations should block this domain at the network level and educate users about common phishing indicators.