tzr-oeknj[.]destiny72[.]workers[.]dev

On August 05, 2026, the domain tzr-oeknj.destiny72.workers.dev was identified as an active generic phishing infrastructure. The domain resolves to the IP address 104.21.3.120, which is owned by Cloudflare, Inc., indicating that the service is hosted behind Cloudflare’s content delivery network. Registration metadata confirms that the domain was provisioned through Cloudflare, Inc., and authoritative nameserver records are not available (NS_NOT_FOUND). Reputation checks show the domain appears on three independent security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal analysis reports that five of ninety‑one scanning engines have flagged the domain as malicious, providing vendor‑level corroboration of phishing activity. The combination of CDN‑based hosting, multiple blocklist listings, and vendor detections justifies the high risk classification assigned to the domain. Nonetheless, observable data lacks a page title, HTTP status code, SSL certificate details, and any extracted brand or payload information, leaving the precise phishing content and target audience unverified.

Defenders should block the domain at DNS and network perimeter, monitor outbound connections to the associated IP address, and incorporate the domain into local and upstream blocklists. Adding the domain to threat‑intel sharing platforms will aid broader community awareness. Further investigation, such as retrieving the HTTP response and analyzing any embedded URLs, is required to fully characterize the phishing campaign and to develop targeted remediation steps.