ldgr-wlt-sf6[.]carlo-a31[.]workers[.]dev

PhishDestroy identifies ldgr-wlt-sf6.carlo-a31.workers.dev as active infrastructure hosting a crypto drainer phishing campaign. The domain is currently under investigation while threat intelligence is gathered. No brand impersonation has been detected at this stage, but the site is flagged as a high-risk crypto theft vector.

This domain was flagged by 4 of 95 VirusTotal vendors during initial scans, indicating minimal detection coverage despite active deployment. Registered through Cloudflare, Inc., the domain resolves to IP 188.114.97.3 and operates under a Let's Encrypt SSL certificate. While creation date and blocklist counts remain unverified, the domain exhibits dynamic worker.dev subdomain behavior typical of evasion tactics. Trust scores are not yet available, and further analysis is pending.

Current status remains active with a risk level marked as under_investigation. Users are strongly advised to avoid interacting with this domain or any associated links. Verify safety on PhishDestroy using seed 3d7645 before proceeding. If exposure occurs, disconnect wallets immediately and revoke any unauthorized permissions. Report findings to PhishDestroy to aid in takedown efforts and improve collective threat intelligence.