linktron25[.]worker-bbb847f2[.]workers[.]dev

This domain, linktron25.worker-bbb847f2.workers.dev, is currently active and classified as a crypto drainer phishing threat with an elevated risk level. Analysis indicates the domain is designed to execute unauthorized cryptocurrency transactions by tricking users into connecting wallets to malicious smart contracts. No legitimate brand impersonation has been identified, but the infrastructure aligns with known crypto-draining campaigns observed in recent months. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and resolves to the IP address 104.21.43.178. The domain was created on February 08, 2019, though the phishing content appears to have been deployed more recently. It is flagged by 2 of 95 security vendors on VirusTotal, with additional detections from three independent security blocklists. The SSL certificate is issued by Google Trust Services, and the site employs HTTP/3 and HSTS protocols, likely to mimic legitimate service infrastructure. Detection engines including MetaMask, SEAL, and PhishDestroy have already classified this domain as malicious. The domain remains active and poses a significant risk to users interacting with cryptocurrency platforms. Security teams are advised to block traffic to 104.21.43.178 and monitor for related subdomains under the workers.dev namespace. Users should verify wallet connection prompts and avoid interacting with unsolicited links, particularly those promising token airdrops or wallet validations. Organizations are encouraged to update endpoint protection rules to include this domain and its associated IP in denylists to prevent potential financial losses.