trzf67sdfsdijiug[.]sd23[.]workers[.]dev

The domain trzf67sdfsdijiug.sd23.workers.dev is a confirmed phishing site engaged in brand impersonation targeting Google. It was designed to deceive users into believing they were interacting with a legitimate Google service, posing a risk of credential theft or fraud. No crypto drainer kit was detected. The site is currently taken offline, but prior activity classified it as a scam.

Technical indicators show trzf67sdfsdijiug.sd23.workers.dev was registered through Cloudflare, Inc. on February 21, 2026, and resolved to the IP address 142.251.179.147, hosted on Google LLC's infrastructure in the US. At the time of analysis, 0 of 95 VirusTotal vendors flagged the domain, and Google Safe Browsing had not issued any warnings. The domain appeared on 1 security blocklist (PhishDestroy). The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Google'. Technologies detected included HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100.

Users who may have interacted with trzf67sdfsdijiug.sd23.workers.dev should immediately change their Google account passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions. Report the phishing domain to Google's abuse team via their reporting form and to the Anti-Phishing Working Group at reportphishing@apwg.org. If financial or personal data was exposed, consider contacting relevant institutions to secure accounts.