little-mode-4179[.]adgde[.]workers[.]dev

Analysis indicates that little-mode-4179.adgde.workers.dev is an active phishing domain posing as a cryptocurrency exchange for USDT to TRX conversion. The domain was registered on March 30, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.97.3, hosted on Cloudflare infrastructure in Canada. The site returns an HTTP 200 status, suggesting it is operational, and its page title explicitly states 'USDT to TRX Conversion,' aligning with the reported scam type of a fake exchange. Infrastructure analysis reveals the use of Cloudflare technologies, including HTTP/3 and HSTS, which may be leveraged to obscure hosting details and enhance perceived legitimacy. The domain lacks assigned nameservers (NS_NOT_FOUND) and is secured with a Let's Encrypt SSL certificate (E8). While VirusTotal scans by 94 vendors show no current detections, this absence does not confirm safety, particularly given the domain's presence on three security blocklists and its active blocking by PhishDestroy, MetaMask, and SEAL. Defenders should treat this domain as high-risk due to its confirmed fake exchange classification, recent registration, and use of Cloudflare to mask origin servers. Network-level blocking is recommended, and any user reports of interaction with this domain should be investigated for potential cryptocurrency theft or credential compromise. The exact content and mechanisms of the scam remain unanalyzed, but the domain's infrastructure and known intelligence strongly support its malicious intent.