linktron7[.]worker-ea4ec4e9[.]workers[.]dev

The domain linktron7.worker-ea4ec4e9.workers.dev was observed hosting a page titled “Coming Soon” that returned an HTTP 404 response. Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which belongs to the Cloudflare network (ASN 13335) and is geolocated in the United States. The domain is registered through Cloudflare, Inc., and its authoritative nameservers are clyde.ns.cloudflare.com and sofia.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and edge services. TLS termination is performed by Google Trust Services under the WE1 certificate, and the site enforces HTTP Strict Transport Security (HSTS) while supporting HTTP/3, confirming a modern Cloudflare configuration.

Threat intelligence flags the site as a “Crypto Scam” and places it on at least one external blocklist. PhishDestroy has already blocked the domain, and a scan on VirusTotal involved 93 antivirus engines, none of which reported a detection at the time of analysis. The absence of detections does not imply safety, especially given the domain’s classification as a cryptocurrency‑related phishing vector. The domain was created on 08 February 2019, which suggests a long‑standing registration that may have been repurposed for malicious activity.

Current evidence is limited to infrastructure and blocklist data; no payload, credential‑harvesting page, or malicious binaries have been captured. Consequently, the exact phishing campaign details, target audience, and any associated command‑and‑control infrastructure remain unknown. Defenders should continue to monitor DNS queries for the domain and its associated IP address, enforce outbound filtering for connections to Cloudflare‑hosted endpoints that match this domain, and ensure that any corporate email filtering solutions reference the blocklist entries that already contain the domain.