ldnbyhefn[.]landry2[.]workers[.]dev

The domain ldnbyhefn.landry2.workers.dev is currently active and employs cloaking techniques to evade detection. It serves benign content to scanners, earning a cloaking score of 5 out of 10. This domain has not yet appeared in any antivirus feeds, as indicated by its 2 out of 95 detection rate on VirusTotal. This reflects its freshness and the early detection capabilities of PhishDestroy, which first identified the domain on June 22, 2026.

Despite its absence from antivirus databases, ldnbyhefn.landry2.workers.dev is already listed on two public blocklists, including PhishDestroy and SEAL. The domain is registered with Cloudflare, Inc., and hosted on the IP address 188.114.97.3. Its SSL certificate is issued by Google Trust Services / WE1, which might lend an appearance of legitimacy to unsuspecting users.

Phishing domains like this one exploit the gap between their registration and the time it takes for antivirus databases to update, typically 24 to 72 hours. PhishDestroy's upstream detection pipeline captures these threats during this critical window, allowing for timely intervention. The use of cloaking further complicates detection efforts, as it enables the domain to present harmless content to security scanners while potentially serving malicious content to targeted victims.