ldnbuiewjdk[.]zakid5[.]workers[.]dev

The domain ldnbuiewjdk.zakid5.workers.dev actively impersonates Google, leveraging a high platform risk score of 98/100. Despite only one out of 95 VirusTotal vendors flagging it as malicious, the domain is listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL. This indicates a targeted effort to exploit users' trust in Google, potentially aiming to harvest sensitive information.

Registered through Cloudflare, Inc., and hosted on an IP address in the United States (172.67.188.15), the domain employs cloaking techniques to evade detection. It serves benign content to scanners, achieving a cloaking score of 5/10. This tactic is designed to delay identification by security tools, allowing the scam to operate longer undetected.

The domain's SSL certificate, issued by Google Trust Services, adds a layer of legitimacy to the scam. This could deceive users into believing they are interacting with a genuine Google service. PhishDestroy's early detection on June 1, 2026, highlights the importance of proactive threat intelligence. By identifying threats during the critical pre-detection window, PhishDestroy captures scams before they propagate through antivirus databases, protecting users from fresh threats.