trzr3545cnct[.]alejandra-330[.]workers[.]dev

Analysis of trzr3545cnct.alejandra-330.workers.dev indicates a recent brand‑impersonation campaign targeting Gmail users. The domain was created on 21 February 2026 and is registered via Cloudflare, Inc. DNS resolution points to 142.250.181.228, an address owned by Google LLC (AS15169) in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 designation, and HTTP responses include HSTS and HTTP/3 headers, suggesting the attacker leveraged legitimate Google infrastructure to increase perceived legitimacy.

An HTTP 403 status is currently returned, and the domain has been taken offline, but historical scans show five of ninety‑three VirusTotal vendors flagged the host as malicious. Trust scoring services reflect extremely low reputations (Gridinsoft 0/100, Scamadviser 1/100), and the page title observed during scanning was "Google," aligning with the declared impersonation of the Gmail brand. The domain appears on a single security blocklist and has been blocked by PhishDestroy, confirming active mitigation by at least one anti‑phishing service.

Uncertainty remains regarding the specific phishing kit or payload used, as no page content beyond the title has been disclosed. Defenders should continue to block the domain at network perimeter devices, monitor outbound connections to the associated IP, and update URL filtering rules to include the full hostname. Threat intelligence feeds should be refreshed to capture any re‑registration attempts, and user awareness campaigns should reference the observed brand‑impersonation pattern to reduce successful credential harvesting.