trozr-kjsdu[.]deylaa12[.]workers[.]dev

PhishDestroy identifies active crypto drainer domain trozr-kjsdu.deylaa12.workers.dev currently under investigation for fraudulent activity. The threat involves cryptocurrency asset theft through deceptive redirection, categorizing this as a crypto drainer operation. Status remains active with escalated security monitoring in place.

This domain was flagged by 10 of 95 VirusTotal security vendors as of the latest scan, indicating undetected malicious behavior. Registered through Cloudflare, Inc., it resolves to IP 172.67.172.52 and utilizes a Google Trust Services SSL certificate. The unique seed identifier 67e270 confirms consistent tracking across threat intelligence platforms. No blocklist entries were identified at time of analysis, with current trust scores remaining uncompromised.

Concrete security actions are required: immediately block domain trozr-kjsdu.deylaa12.workers.dev and IP 172.67.172.52 at network perimeter. Implement DNS sinkholing for this Workers.dev subdomain to prevent endpoint resolution. Conduct thorough cryptocurrency wallet monitoring for any recent unauthorized transactions. Security teams should deploy Cloudflare Workers behavioral analysis rules targeting crypto drainer signatures. Continuous monitoring of this domain seed 67e270 is advised due to active phishing campaign potential.