tzr-oiekd[.]destiny72[.]workers[.]dev

The domain tzr-oiekd.destiny72.workers.dev is currently flagged as a generic phishing infrastructure. Registration data indicates the domain is provisioned through Cloudflare, Inc., a common registrar for short‑lived malicious sites. DNS resolution points to the IPv4 address 172.67.130.173, which belongs to Cloudflare's edge network, suggesting the operator is leveraging Cloudflare's reverse‑proxy services to hide the true origin server. The domain’s authoritative nameserver information could not be retrieved (NS_NOT_FOUND), limiting direct assessment of its DNS configuration.

Observational data shows the domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy threat‑intelligence feed. No additional detection counts, page titles, or SSL certificate details are available in the current intelligence set, and the site’s HTTP response characteristics have not been captured. Consequently, the precise content served by the host remains unknown, and attribution beyond the generic phishing label cannot be confirmed.

Defenders should treat the domain as hostile. Recommended mitigations include adding the domain to local deny lists, configuring network perimeter filters to drop traffic to 172.67.130.173 when associated with the observed host header, and monitoring Cloudflare‑registered domains for similar patterns. Continuous re‑evaluation is advised, as the infrastructure may evolve or acquire additional detections in other threat feeds.