trzr3545rhkdtz[.]sr3[.]workers[.]dev

The domain trzr3545rhkdtz.sr3.workers.dev was created on 21 February 2026 and is registered through Cloudflare, Inc. Its authoritative nameservers are clyde.ns.cloudflare.com and sofia.ns.cloudflare.com, indicating that the hosting is provided by Cloudflare’s edge network. DNS resolution points to IP address 172.67.191.73, which belongs to AS13335, a Cloudflare‑owned address block located in the United States. The site presented the page title “Welcome to Suite” and was served over HTTPS with a certificate issued by Google Trust Services under the WE1 label, confirming the use of valid TLS. HTTP responses returned a 403 status code, and the server advertised HSTS and HTTP/3 support, consistent with Cloudflare’s default security stack.

Threat analysis identifies the domain as a wallet/seed phishing operation that impersonates the brand “argent”. The phishing intent is corroborated by the classification in the intelligence feed and by the fact that the site has been blocked by the PhishDestroy blocklist. Independent scanning on VirusTotal recorded 12 detections out of 93 participating security vendors, and the domain appears on at least one additional security blocklist. Conversely, the Gridinsoft rating assigned a trust score of 0 out of 100, reflecting a highly malicious assessment. As of the report date, the infrastructure has been taken offline, and the domain is listed as offline in current monitoring tools.

Defenders should continue to block the domain at perimeter filters, DNS resolvers, and web proxies, referencing the observed IP address and the known nameserver set. Given the Cloudflare hosting, additional scrutiny of other subdomains under the same account may be warranted, as threat actors often recycle the same edge infrastructure for multiple campaigns. Continuous monitoring of VirusTotal, PhishDestroy, and other blocklist feeds for re‑appearance or new detections is recommended.