t9jz-rz7w-mzfi[.]rsadler[.]workers[.]dev

The domain t9jz-rz7w-mzfi.rsadler.workers.dev is currently listed as an active generic phishing site with an elevated risk rating. The domain was created on 08 February 2019 and is registered through Cloudflare Workers, a serverless platform that masks the underlying hosting infrastructure and can serve content from any edge location. VirusTotal analysis shows that 14 of 91 antivirus and URL‑reputation engines have flagged the domain as malicious, providing a moderate‑to‑high confidence signal of abusive activity. Independent threat‑intelligence feeds have taken action: PhishDestroy has placed the domain on its blocklist and it also appears on one additional security blocklist, confirming that at least two community sources consider the host to be hostile.

No public page title, SSL certificate details, HTTP response codes, or explicit impersonated brand have been disclosed in the available intelligence, so the exact phishing lure (e.g., login credential harvest, credential‑validation page) remains uncertain. The lack of observable page metadata limits attribution of the specific victim‑targeted brand, but the generic phishing classification is supported by the vendor detection count and blocklist entries. Defenders should treat traffic to t9jz-rz7w-mzfi.rsadler.workers.dev as malicious. Recommended mitigations include adding the domain to DNS‑based blocklists, configuring web proxies or firewalls to deny HTTP/HTTPS requests to the host, and updating endpoint URL‑reputation databases with the latest detection signatures.

Continuous monitoring for DNS queries or outbound connections to the domain will help detect compromised clients. Because the underlying server is abstracted by Cloudflare Workers, takedown requests directed at a traditional hosting provider are unlikely to succeed; instead, coordination with Cloudflare’s abuse team may be required if further evidence of abuse is gathered.