cloud-open-9trq[.]p-oqmylewv[.]workers[.]dev

PhishDestroy identifies cloud-open-9trq.p-oqmylewv.workers.dev as an active crypto drainer domain posing as a cloud service. The page mimics a legitimate file-sharing interface to trick users into connecting wallets, triggering unauthorized token transfers. No specific brand impersonation was detected in current scans, but the drainer kit is designed to siphon cryptocurrency assets upon wallet connection. This domain resolves to IP 188.114.96.3 and is registered via Cloudflare, Inc. The Let’s Encrypt SSL certificate adds superficial legitimacy. VirusTotal flags show 11 out of 95 security vendors have detected malicious activity, placing it in the elevated risk tier. The domain was created recently and shows no presence on Google Safe Browsing (GSB), while third-party blocklists already include this domain in their feeds. As of the latest scan, the domain remains active and accessible. Immediate takedown actions have not been confirmed. Users are advised to avoid interaction and verify site safety through PhishDestroy’s real-time checks. Remaining risk is elevated due to active hosting and detectable drainer payloads.