trzr3545rhkdtz[.]df87[.]workers[.]dev

This domain, trzr3545rhkdtz.df87.workers.dev, is a confirmed credential phishing site hosted on Cloudflare Workers infrastructure. Registered on February 21, 2026, through Cloudflare, Inc., the domain currently resolves to IP address 104.21.67.203 (AS13335, United States) and is associated with a Google Trust Services SSL certificate (WE1). As of July 23, 2026, the domain returns an HTTP 403 status, indicating access is blocked, and its page title explicitly states 'Suspected phishing site | Cloudflare.' Detection data reveals the domain is flagged by 12 of 95 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy, which classifies it as a credential phishing threat.

Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. Technologies detected include HSTS, Cloudflare, and HTTP/3, consistent with modern phishing infrastructure leveraging Cloudflare's network for evasion. While the exact brand or service being impersonated is not specified in available data, the credential phishing classification suggests the site likely targeted login credentials for financial, corporate, or personal accounts.

Defenders should treat this domain as high-risk and ensure it is blocked at the DNS, proxy, and endpoint levels. Given its current offline status, monitoring for re-emergence under the same or similar Cloudflare Workers subdomains is recommended. No evidence links this domain to a specific phishing kit or campaign beyond the generic credential phishing classification.