purple-cell-f273[.]ahjfr[.]workers[.]dev

This domain operates as a crypto drainer phishing site designed to deceive users into authorizing malicious transactions under the guise of USDT to TRX conversion or TRON energy purchases. The fraudulent interface mimics legitimate cryptocurrency services, presenting itself as a fast and secure platform to trick victims into connecting their wallets. Once connected, the site executes unauthorized transfers, draining funds from the victim's wallet without consent. The page title, 'USDT to TRX Conversion & TRON Energy Purchase | Fast, Secure, Reliable,' reinforces the illusion of legitimacy while concealing its malicious intent. Analysis indicates the domain was registered through Cloudflare, Inc. on March 30, 2026, an unusually future-dated creation that suggests domain spoofing or registry manipulation. It resolves to the IP address 172.67.159.57, located in Canada and associated with Cloudflare's infrastructure. Despite its recent deployment, the domain has already been flagged by three security blocklists, including PhishDestroy and SEAL. Notably, VirusTotal reports 0 detections out of 95 engines, highlighting the site's ability to evade initial detection while remaining actively harmful. Users who have visited this domain or interacted with its content should immediately revoke any wallet permissions granted to the site. Disconnect all connected wallets and review recent transactions for unauthorized activity. If funds were transferred, document the transaction hashes and report the incident to relevant blockchain explorers and cybersecurity authorities. Monitor accounts for further suspicious activity, as crypto drainers often deploy follow-up attacks. Exercise caution with any domain hosted on workers.dev subdomains, particularly those offering cryptocurrency services without verifiable credentials.