twhsl-qkns-r1he[.]p-5jwrf2lw[.]workers[.]dev

The domain twhsl-qkns-r1he.p-5jwrf2lw.workers.dev is identified as an active crypto drainer scam. This threat type specifically aims to steal cryptocurrency assets by tricking victims into submitting sensitive wallet credentials. The site remains live and poses a high risk to users who may encounter it through phishing attacks.

PhishDestroy analysis shows this domain is flagged by 9 out of 95 security vendors on VirusTotal, indicating a notable detection consensus. The domain is registered via Cloudflare, Inc., and it resolves to the IP address 188.114.97.3. It currently appears on 1 security blocklist and is blocked by OpenPhish, confirming its malicious reputation. The site utilizes a Let's Encrypt SSL certificate, which may create a false sense of security. The page title is reported as "Loading..." which may be used to mask the malicious content.

As of now, the domain remains active and continues to pose a serious threat. Users are strongly advised not to interact with this domain or provide any private information related to cryptocurrency wallets. It is recommended to rely on trusted channels and verify suspicious links on PhishDestroy. Network administrators should consider blocking this domain at DNS and firewall levels to prevent exposure to this high-risk scam.