ntrhkls.suczrrhns.workers.dev
Category: Phishing
- Don't sign in or pay here. Close it. If you typed a password, change it where you normally use it.
- Already visited? Check your device. A free scan shows whether anything was installed.
- Stop the next one. Combo Cleaner's web protection blocks phishing and scam sites before they load.
Combo Cleaner is PCrisk's own anti-malware tool, owned by RCS LT. Free to scan; removing what it finds needs a licence (7-day free trial).
Description of ntrhkls.suczrrhns.workers.dev
This domain is hosted on a Cloudflare Workers subdomain and appears to present a French-language payment or banking-themed page branded as “Wero - Instant Sécurité.” The visible content says “VOUS AVEZ UN VIREMENT WERO EN ATTENTE” and invites the visitor to continue, suggesting a workflow related to receiving a transfer or validating account details.
Based on the page content and linked assets, the site appears to reference multiple French banking brands and payment-related imagery. The scan context indicates that the page presents itself as Wero, although it does not appear to be on Wero’s official domain. Rather than operating as an independent informational site, it appears to be a hosted web page designed to imitate a financial-service interaction.
Safety Assessment for ntrhkls.suczrrhns.workers.dev
The page appears to be a phishing-style website that presents itself as Wero and asks visitors to pay, log in, or enter account, card, or identity details. The domain does not match Wero’s official site, and the page content closely aligns with common credential-harvesting or payment-redirection patterns. The linked image assets referencing multiple banks further strengthen the impression that the page may be attempting to impersonate a financial service in order to collect sensitive information.
At the time of this scan, malware scanners did not report file-based threats, and blacklist and threat-database checks did not show active listings. However, the absence of malware detections does not outweigh the page’s apparent impersonation behavior and phishing-style content. Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site is served through Cloudflare infrastructure on a workers.dev subdomain, with a valid Let’s Encrypt SSL certificate observed at the time of scanning. The server resolved to a Cloudflare IP in Toronto, Canada, and the domain’s DNSSEC status appears to be unsigned. The underlying parent domain has been registered for several years, although this does not by itself validate the legitimacy of content hosted on a specific subdomain.
From a technical perspective, the page uses common third-party frontend resources such as Tailwind CSS and Google Fonts, and no malicious files or flagged external links were detected during the scan. Even so, the use of a disposable-looking subdomain combined with financial-brand imagery and impersonation-style content may be a notable security concern.
Share your experience with this website. Was it safe? Did you encounter any issues?