lzrstbg67fgh5fd[.]sd96asd[.]workers[.]dev

This investigation report examines the domain lzrstbg67fgh5fd.sd96asd.workers.dev, a subdomain hosted on Cloudflare Workers infrastructure and currently classified as generic phishing activity. As of August 04, 2026, the domain remains active and under analysis. Infrastructure analysis reveals the domain is served via Cloudflare's edge network, a common hosting choice for phishing campaigns due to its free tier, rapid deployment, and difficulty in takedown enforcement. The domain name itself exhibits no discernible brand association, consisting of randomized alphanumeric strings (lzrstbg67fgh5fd) appended to a Cloudflare Workers subdomain (sd96asd.workers.dev), a pattern frequently observed in disposable phishing URLs. Detection data indicates limited visibility across security vendors.

The domain appears on a single security blocklist, suggesting early-stage detection or low-volume activity. No detections were recorded among the 91 vendors that scanned the domain on VirusTotal, though the absence of flags does not confirm legitimacy. PhishDestroy has blocked the domain, indicating at least one commercial security provider has classified it as malicious. No additional context regarding the phishing kit, targeted brand, or specific scam type is available at this time, as the exact content of the site has not been analyzed. Defenders are advised to treat this domain with caution.

The use of Cloudflare Workers infrastructure complicates traditional takedown and attribution efforts, as the platform does not require domain registration details and allows rapid redeployment. Network-level blocking of the domain is recommended for organizations using PhishDestroy or similar solutions. Given the lack of widespread detection, monitoring for related subdomains or IP-based indicators may be prudent, though no associated IPs or ASN data are currently available. Further analysis is required to determine the scope, target, and persistence of this campaign.