rby-ojdj[.]allyse10[.]workers[.]dev

Analysis of the domain rby-ojdj.allyse10.workers.dev indicates a high-risk phishing operation targeting cryptocurrency wallet users. The domain was registered on June 8, 2026, through Cloudflare Workers, a platform often leveraged for rapid deployment of malicious infrastructure due to its ephemeral and low-cost nature. As of July 29, 2026, the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, which specialize in identifying threats to financial and crypto-related services. VirusTotal telemetry shows 13 of 91 security vendors flagging the domain, though the absence of additional context limits conclusions about the specific payload or attack vector.

Infrastructure analysis reveals the domain is hosted on Cloudflare’s edge network, which provides SSL encryption and obscures the origin server’s IP address. No HTTP status or page title data is currently available, and the exact content of the site remains unanalyzed. However, the inclusion on MetaMask’s blocklist suggests the phishing attempt likely involves credential harvesting or transaction redirection for cryptocurrency wallets.

Defenders should treat this domain as active and high-risk, particularly in environments where crypto-related services are accessed. Network-level blocking is recommended, along with monitoring for connections to the domain in logs or proxy data. Further investigation into associated IP ranges or SSL certificates may reveal additional linked infrastructure, though no such indicators are presently confirmed.