super-union-f1e3[.]aedfv[.]workers[.]dev

PhishDestroy identifies super-union-f1e3.aedfv.workers.dev as an active generic phishing domain leveraging Cloudflare Workers to deliver credential theft pages. The site masquerades as a legitimate service portal, employing social engineering to harvest user login credentials. No specific brand is impersonated in the observed payload, indicating a broad opportunistic campaign designed to capture credentials across multiple services.

EXACT technical indicators include 0/95 VirusTotal detections, Let’s Encrypt SSL certificate, resolution to IP 188.114.96.3, and registration via Cloudflare, Inc. The domain remains unblocked by Google Safe Browsing with no entries in public blocklists. Creation and hosting on Cloudflare Workers infrastructure provide anonymity and rapid deployment, reducing detection surface.

This domain remains active and poses ongoing risk to unprotected users. Immediate takedown requests should be filed with Cloudflare and VirusTotal. Users are advised to avoid interaction and enable browser-based phishing protection. Remaining risk is high until the domain is globally blocked and deactivated.