spring-bush-e4e9[.]sfersjgd[.]workers[.]dev

The domain spring-bush-e4e9.sfersjgd.workers.dev is currently classified as an active generic phishing site with an elevated risk rating. VirusTotal analysis shows that 15 of 91 security vendors have flagged the domain as malicious, indicating a moderate level of consensus among detection engines. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, further confirming its abusive nature.

No additional technical artifacts such as page titles, SSL certificate details, IP geolocation, or registrar information were provided in the available intelligence, leaving those aspects of the infrastructure unverified at this time. The lack of publicly disclosed content or brand impersonation means analysts cannot definitively state which legitimate service the phishing attempt may be targeting, but the classification as generic phishing suggests a broad credential‑harvesting intent. Defensive teams should continue to block the domain at network perimeters and update endpoint protection signatures to include the 15 vendor detections.

Monitoring for new indicators of compromise, such as DNS queries to the domain or related subdomains, is advised. Organizations should also consider adding the domain to internal threat‑intel feeds and alerting users about potential phishing attempts originating from obscure cloud‑based URLs, especially those hosted on the workers.dev infrastructure.