# trozr-sf8d.brionnaa4.workers.dev — SUSPICIOUS

> Trozr-sf8d.workers.dev is a credential-stealing phishing domain with 0/95 VirusTotal detections. Check the full report for detailed safety guidance.

## Summary
PhishDestroy identifies trozr-sf8d.brionnaa4.workers.dev as a live credential-stealing phishing domain. The site mimics login portals to trick visitors into surrendering usernames and passwords, and is currently under active analysis after being reported by multiple security vendors.


This domain was flagged by PhishDestroy on 2024-05-16 with a constructed seed of 17e1be. Evidence shows it currently resolves to IP 104.21.43.161 and is served through Cloudflare’s edge network, yet it has evaded detection with a clean 0 out of 95 VirusTotal verdicts. The domain uses a valid Let’s Encrypt SSL certificate to appear trustworthy, further lowering user suspicion.


If you visited trozr-sf8d.brionnaa4.workers.dev, assume your login credentials may have been compromised. Clear your browser’s cached passwords for that site, enable two-factor authentication on any accounts you entered, and scan your device with updated antivirus software. Report the domain to your IT team or security vendor immediately to help block its infrastructure and protect others.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 104.21.43.161

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/5c4f4b30-f423-49b3-bf1c-9ed846a4664d
- PhishDestroy: https://phishdestroy.io/domain/trozr-sf8d.brionnaa4.workers.dev/
- LLM endpoint: https://phishdestroy.io/domain/trozr-sf8d.brionnaa4.workers.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/trozr-sf8d.brionnaa4.workers.dev/
Last updated: 2026-03-30