trzr3545refd[.]kyjuan-13[.]workers[.]dev

Analysis of trzr3545refd.kyjuan-13.workers.dev, observed on July 23 2026, indicates that the domain is being used for brand impersonation targeting Gmail users. The domain was created on February 21 2026 and is hosted behind Cloudflare’s network (AS13335). DNS resolution points to 142.251.156.119, an IP owned by Cloudflare in the United States. The site presents a page title of "Google" and serves an SSL certificate issued by Google Trust Services under the WE1 label, which may be intended to lend credibility to the impersonation attempt. HTTP responses return a 403 status, and the server advertises HSTS, HTTP/3, and Cloudflare as underlying technologies.

Security telemetry shows that 16 of 93 VirusTotal scanners have flagged the domain, and it appears on one public blocklist. The domain is also listed by PhishDestroy as a blocked entity, and the Gridinsoft trust score is 0 out of 100, indicating a highly malicious classification. Nameservers are clyde.ns.cloudflare.com and sofia.ns.cloudflare.com, both standard Cloudflare resolvers. The use of the workers.dev subdomain suggests the attacker leveraged Cloudflare Workers to serve content, a technique that can evade some URL filtering because the parent domain is widely trusted. Current status is offline, so no live content can be inspected, and no detailed page layout or credential‑capture mechanism has been captured.

Defenders should add the domain to internal blocklists, enforce DNS sinkholing for the domain and its associated IP range, and monitor for any outbound connections to the Cloudflare IP. Email security gateways should flag any messages containing links to this domain as malicious, especially those claiming to request Gmail credentials. Continuous monitoring of Cloudflare‑hosted IPs that appear in phishing reports is advised, as the infrastructure can be reused for future campaigns.