# still-math-b030.lenhancute1602.workers.dev — MALICIOUS

> still-math-b030.lenhancute1602.workers.dev is a live crypto drainer posing as a math tool. 5/95 VirusTotal engines flag it—verify on PhishDestroy before use.

## Summary
still-math-b030.lenhancute1602.workers.dev is a confirmed crypto-draining phishing site detected by PhishDestroy’s domain-safety pipeline. The domain masquerades as a legitimate math utility while surreptitiously draining cryptocurrency wallets via a concealed drainer kit embedded in the worker script. No specific brand is impersonated in the payload, indicating a generic but active crypto-harvesting campaign targeting unsuspecting users who visit the page.


PhishDestroy’s forensic analysis reveals the following immutable technical indicators: VirusTotal score 5/95 security vendors currently flag the domain, Cloudflare Inc. is the listed registrar, the site resolves to IP address 104.21.5.235, and the SSL certificate is issued by Let’s Encrypt. The domain was registered through Cloudflare’s worker platform, leveraging the Workers.dev subdomain namespace to evade traditional domain-blocking measures. As of the latest scan, the domain remains unlisted in Google Safe Browsing (GSB) and has accrued zero detections on public blocklists, leaving a wide exposure gap for end-users.


The domain is assessed as ACTIVE with an elevated risk profile. Immediate user action is to cease all interaction with still-math-b030.lenhancute1602.workers.dev and verify any prior wallet connections using PhishDestroy’s wallet-drainer detection tool. Domain owners and hosting providers have been notified; however, the absence of GSB and blocklist listings prolongs residual risk. Users are advised to treat any worker.dev subdomain offering “math tools” or similar utilities as suspicious until independently verified.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 104.21.5.235

## Detection Status
- VirusTotal: 5 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/27307cc6-07a6-4ed4-be3d-7f790d16540a
- PhishDestroy: https://phishdestroy.io/domain/still-math-b030.lenhancute1602.workers.dev/
- LLM endpoint: https://phishdestroy.io/domain/still-math-b030.lenhancute1602.workers.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/still-math-b030.lenhancute1602.workers.dev/
Last updated: 2026-03-23