chrji-fhav-oz04[.]p-qtlv10l7[.]workers[.]dev

PhishDestroy identifies chrji-fhav-oz04.workers.dev as an active crypto drainer targeting cryptocurrency users. This Workers.dev subdomain employs deceptive tactics to trick victims into connecting wallets and authorizing malicious transactions. The threat is elevated due to the immediate financial impact posed by unauthorized fund transfers. This domain was flagged by 9 out of 95 security vendors on VirusTotal, indicating widespread suspicion in the cybersecurity community. It resolves to IP 104.21.50.90, a Cloudflare Workers hosting environment commonly abused by threat actors for phishing infrastructure. The domain is registered through Cloudflare, Inc., leveraging their DNS and SSL services to appear legitimate. Using a Let's Encrypt SSL certificate, it mimics secure connections to increase trust. The Workers.dev subdomain structure is often chosen for its obscurity and rapid deployment capabilities, making detection and takedown more challenging. To mitigate risk, users must avoid interacting with this domain or any links associated with it. If you have visited chrji-fhav-oz04.workers.dev, disconnect your wallet immediately, revoke any unauthorized permissions, and transfer remaining funds to a secure wallet. Always verify URLs and use PhishDestroy’s real-time scanner before entering credentials or connecting wallets. Report this domain to PhishDestroy to aid in blocking efforts and protect others from potential harm.