linktron34[.]worker-783a6710[.]workers[.]dev

Analysis of the domain linktron34.worker-783a6710.workers.dev indicates it was associated with a crypto scam phishing campaign, currently offline as of July 24, 2026. The domain was registered on February 8, 2019, through Cloudflare, Inc., and resolves to the IP address 172.67.212.193, which is part of AS13335 (Cloudflare, Inc.) located in the United States. The infrastructure relies on Cloudflare nameservers (clyde.ns.cloudflare.com and sofia.ns.cloudflare.com) and employs security features including HSTS and HTTP/3, alongside a Google Trust Services SSL certificate (WE1). At the time of assessment, the domain returned an HTTP 404 status, and its page title was listed as 'Coming Soon,' suggesting either a placeholder or inactive state.

Detection data reveals limited but targeted flagging: one security vendor on VirusTotal identified the domain as malicious, and it appears on a single blocklist maintained by PhishDestroy. The scam type is explicitly classified as a crypto scam, though specific tactics, lures, or targeted brands remain unconfirmed due to the domain's offline status and lack of additional contextual evidence. No further details regarding the phishing kit, victim interaction, or payload delivery are available in the observable data. Defenders should note that while the domain is currently offline, its prior association with a crypto scam and minimal but present detection signals warrant continued monitoring.

The use of Cloudflare infrastructure, while common for legitimate services, is also frequently leveraged by threat actors to obscure origin servers and evade takedowns. Organizations may consider preemptive blocking of the domain and its resolved IP (172.67.212.193) in environments where crypto-related phishing poses a heightened risk. Given the single detection on VirusTotal, cross-referencing with additional threat intelligence sources is recommended to assess broader consensus on its malicious status.