rapid-firefly-549b[.]asvgd[.]workers[.]dev

PhishDestroy identifies rapid-firefly-549b.asvgd.workers.dev as an active crypto drainer domain currently under forensic analysis. The site exhibits behavior consistent with cryptocurrency wallet-draining malware, attempting to trick users into connecting wallets under the guise of a reward or verification portal. No specific brand impersonation has been confirmed at this stage, but the drainer kit appears to target multiple wallet providers via malicious JavaScript payloads. The domain leverages Cloudflare’s Workers platform to serve its payload, which is a common technique to bypass traditional web filtering and obscure the true origin of the malicious code. This domain resolves to IP address 104.21.95.78 and is registered through Cloudflare, Inc., utilizing a Let's Encrypt SSL certificate to appear legitimate. VirusTotal currently shows 0 detections out of 95 engines, indicating it has not yet been widely flagged by antivirus platforms. The domain’s age and history remain under analysis, though its association with a crypto drainer kit places it in a high-risk category for cryptocurrency users. At this time, it has not been observed on Google Safe Browsing (GSB) or major blocklists, suggesting it may be newly deployed or operating under the radar. As of the latest assessment, the site remains active and accessible, with no active takedown efforts observed from hosting or registrar providers. PhishDestroy continues to monitor this domain and is coordinating with threat intelligence partners to gather additional IOCs (Indicators of Compromise). The current risk level is classified as 'under_investigation,' but users are strongly advised to avoid any interaction with this domain, especially wallet connections. Verify this domain’s status on PhishDestroy before proceeding. Remaining risk is assessed as high due to the active drainer payload and low detection coverage, posing significant danger to cryptocurrency holders.