redirect[.]xrestinghighworkersdev[.]workers[.]dev

redirect.xrestinghighworkersdev.workers.dev is a tenant hostname on Cloudflare, not a separately registered domain. PhishDestroy first observed the hostname on Aug 20, 2026. The captured page title is “Google”. Current evidence score: 68/100 (high).

One source contains a positive finding: SEAL. SEAL listed the hostname in the separate external-blocklist snapshot on Aug 20, 2026 at 06:20 UTC. Non-positive and contextual checks: On Aug 20, 2026 at 02:32 UTC, VirusTotal recorded 0 detections among 91 engines; Google Safe Browsing returned no flag. URLScan completed without a malicious verdict (score 0) on Aug 20, 2026 at 05:08 UTC. The 0/91 VirusTotal snapshot and the positive findings above are conflicting observations from different sources or collection times.

The collector marked the hostname reachable on Aug 20, 2026 at 02:00 UTC, but did not retain the HTTP response code. Cloudflare is the hosting platform for this tenant, not its registrar. At collection time, the hostname resolved to 188.114.97.3 on AS13335 (Cloudflare, Inc.). The IP and ASN identify shared Cloudflare infrastructure, not the tenant operator. The stored server header is gws. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. The platform TLS certificate was issued by Google Trust Services with validity through Oct 1, 2026; checked Aug 20, 2026 at 04:02 UTC.

Stored content provides classification context, but only one source contains a positive finding. The stored fields do not identify an impersonated brand or victim interaction.