# connectwallet.tron-link.workers.dev — SUSPICIOUS

> connectwallet.tron-link.workers.dev is a crypto drainer posing as a TRON wallet service. This active domain has 0/95 VirusTotal detections and steals.

## Summary
PhishDestroy identifies connectwallet.tron-link.workers.dev as an active crypto drainer targeting TRON wallet users. The domain mimics legitimate wallet services (TRON-Link) to trick victims into connecting wallets and approving fraudulent transactions. This threat leverages a well-known cryptocurrency drainer kit associated with seed 5aebb1, enabling automatic fund siphoning upon wallet connection.  This domain resolves to IP 172.67.130.170 (Cloudflare infrastructure) and operates under Google Trust Services' SSL certificate. VirusTotal currently flags it with 0/95 detections, indicating it remains undetected by most antivirus engines. Registered through Cloudflare, Inc., this domain's infrastructure suggests an attempt to obscure its malicious nature. The Workers.dev subdomain indicates potential abuse of legitimate cloud services.  Current status shows active operation with no detections, though PhishDestroy has flagged it under investigation. Users encountering this domain should block it immediately and avoid any wallet connection attempts. The remaining risk is high due to the domain's undetected status and TRON wallet targeting, necessitating urgent updates to threat intelligence feeds.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.67.130.170

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/a5646687-16bc-408c-8a95-1ac54cd925fa
- PhishDestroy: https://phishdestroy.io/domain/connectwallet.tron-link.workers.dev/
- LLM endpoint: https://phishdestroy.io/domain/connectwallet.tron-link.workers.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/connectwallet.tron-link.workers.dev/
Last updated: 2026-03-30