trozr-bv6r[.]kjgt65yh[.]workers[.]dev

PhishDestroy identifies trozr-bv6r.kjgt65yh.workers.dev as an active crypto drainer domain designed to steal cryptocurrency assets from unsuspecting users. This domain leverages Cloudflare Workers to host malicious scripts that monitor clipboard activity, replace wallet addresses with attacker-controlled addresses, and facilitate unauthorized fund transfers. The threat is confirmed via behavioral analysis, with the domain exhibiting patterns consistent with clipboard manipulation malware observed in prior campaigns targeting crypto users. This domain was flagged with 0 detections out of 95 VirusTotal engines, indicating it has evaded immediate detection by antivirus solutions. It resolves to IP address 188.114.96.3, a Cloudflare IP range commonly abused by threat actors to obfuscate malicious infrastructure. The domain is registered through Cloudflare, Inc., a legitimate service provider exploited for anonymity, and secured with a Let's Encrypt SSL certificate to appear trustworthy. Despite its recent deployment, the domain has already been observed in one active blocklist, though its low detection rate suggests it remains under the radar of most security vendors. Users who have visited trozr-bv6r.kjgt65yh.workers.dev should immediately check their clipboard history and wallet addresses for any unauthorized modifications. Disconnect any connected wallets and revoke permissions via your wallet provider's security settings. Scan your device with updated antivirus software and consider using a hardware wallet for future transactions. Report this domain to PhishDestroy and your wallet provider to prevent further abuse. Avoid interacting with this domain entirely, as it poses a high risk of financial loss.