trzr3545rhkdtz[.]sd8g[.]workers[.]dev

Analysis indicates that the subdomain trzr3545rhkdtz.sd8g.workers.dev is currently classified as a generic phishing resource. The domain is hosted on the Cloudflare Workers platform, as indicated by the “workers.dev” suffix, which provides serverless edge execution and often serves as a convenient front‑end for malicious actors. VirusTotal records show that the domain was submitted to 91 scanning engines, none of which raised a detection at the time of analysis. While the lack of detections does not imply benign intent, it demonstrates that the payload or landing page has not yet been fingerprinted by public scanners.

The domain is listed on a single external blocklist and has been explicitly added to the PhishDestroy blocklist, confirming that at least one anti‑phishing community has observed malicious activity associated with it. No additional intelligence such as registrar details, IP address, SSL certificate metadata, HTTP response codes, Safe Browsing verdicts, or Open Threat Exchange tags are presently available. Consequently, the precise hosting infrastructure, certificate validity, and page content remain unknown. The threat is marked as “active” and “under investigation,” indicating ongoing monitoring by security teams.

Defenders should consider adding the domain to network‑level deny lists, enforcing URL filtering policies, and monitoring outbound connections for attempts to resolve or contact the subdomain. Continuous re‑scanning with multi‑engine services is advised to capture any future payload changes. Organizations should also review any user‑reported phishing attempts that reference this domain and correlate them with internal logs to identify potential compromise vectors.