raspy-pond-c31a[.]zdser[.]workers[.]dev

Analysis of raspy-pond-c31a.zdser.workers.dev indicates a high-risk cryptocurrency conversion scam targeting users attempting USDT to TRX swaps. The domain was registered on March 31, 2026, through Cloudflare and currently resolves to IP 188.114.96.3. Infrastructure analysis reveals Cloudflare hosting with HSTS and HTTP/3 enabled, alongside a Let's Encrypt SSL certificate, which are common among both legitimate and malicious sites but provide no inherent safety assurance. The domain appears on three security blocklists and is actively blocked by SEAL, MetaMask, and PhishDestroy, suggesting prior detection of fraudulent activity. While only two of ninety-five security vendors flagged this domain in recent scans, this limited detection does not confirm safety, particularly given the domain's recent creation and active status. The page title explicitly references 'USDT to TRX Conversion,' aligning with known tactics used in cryptocurrency swap scams to lure victims into fake exchange platforms. No specific phishing kit or brand impersonation has been confirmed beyond this title, and the exact content or functionality of the site remains unanalyzed. Defenders should treat this domain as malicious, block resolution at the network level, and monitor for related subdomains or IPs within the same infrastructure. Given the domain's continued activity as of July 12, 2026, users should avoid interaction and report any associated wallet addresses or transaction prompts to relevant fraud tracking services.