linktron26[.]worker-bbb847f2[.]workers[.]dev

The domain linktron26.worker-bbb847f2.workers.dev was identified as a crypto‑focused phishing infrastructure and taken offline as of July 24, 2026. Registration data shows the domain was created on February 08, 2019 and was provisioned through Cloudflare, Inc., using the nameservers clyde.ns.cloudflare.com and sofia.ns.cloudflare.com. DNS resolution points to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. An SSL certificate issued by Google Trust Services (WE1) validates the domain, while HTTP headers indicate the presence of HSTS, Cloudflare edge services, and HTTP/3 support.

A simple HTTP GET returned a 404 status and the page title "Coming Soon," suggesting that the site was either a placeholder or deliberately removed after detection. The threat was catalogued as a crypto scam, and one of ninety‑three VirusTotal scanners flagged the domain as malicious. It appears on a single security blocklist and has been blocked by the PhishDestroy mitigation service.

No additional content analysis is available beyond the page title, leaving the exact phishing payload or lure unknown. Defenders should continue to block the domain and its associated IP address, monitor Cloudflare‑hosted sub‑domains for similar patterns, and consider adding the IP to network‑level deny lists. Ongoing surveillance of the Cloudflare ASN for new domains exhibiting the same registration and SSL characteristics is recommended to pre‑empt further deployments of this infrastructure.