linktron31[.]worker-1d051cb0[.]workers[.]dev

Analysis of linktron31.worker-1d051cb0.workers.dev shows the domain is hosted behind Cloudflare infrastructure (AS13335) with the edge IP 104.21.6.67 located in the United States. The domain was registered on February 8, 2019 through Cloudflare, Inc., and continues to use Cloudflare’s default authoritative name servers clyde.ns.cloudflare.com and sofia.ns.cloudflare.com. TLS termination is provided by a Google Trust Services certificate (WE1) and the site enforces HTTP Strict Transport Security (HSTS) while supporting HTTP/3. An HTTP request returns a 404 status code and the only visible page title is "Coming Soon," indicating that no active phishing page is currently being served.

The domain is classified as a crypto‑related scam, and it has been blocked by the PhishDestroy feed and listed on one external security blocklist. VirusTotal scanning recorded a single positive detection out of 93 scanned engines, suggesting limited but non‑trivial malicious interest. Current observations confirm the site is offline, so active exploitation cannot be confirmed at this time.

Uncertainty remains regarding the specific payload or lures that may have been hosted before takedown, as no page content beyond the placeholder title has been captured. Defenders should proactively block the domain at DNS and proxy layers, add it to URL filtering policies, and monitor the underlying worker subdomain pattern for re‑appearance. Continuous threat‑intel sharing with upstream blocklist providers is advised, as well as periodic re‑resolution checks to detect any future activation of the site.