yqgqt-mnec-vbcz[.]c-0zsklfju[.]workers[.]dev

Analysis indicates that the domain yqgqt-mnec-vbcz.c-0zsklfju.workers.dev was registered on May 07, 2026 through Cloudflare, Inc. and resolves to IP address 188.114.96.3, which is owned by Cloudflare in Canada. The site serves content over HTTPS with a valid Let’s Encrypt /E7 certificate, enforces HSTS and supports HTTP/3, suggesting a modern delivery stack. HTTP response code 200 was observed, and the page title returned is "Loading...". Security telemetry shows the domain is flagged by 15 of 92 VirusTotal scanners, appears on one public blocklist, and has been blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0/100, reinforcing the high‑risk classification. The infrastructure details, including the use of Cloudflare’s workers.dev sub‑domain, obscure the true origin of the payload and complicate attribution. The campaign is identified as a crypto drainer, targeting users to illicitly transfer cryptocurrency assets. Defenders should add the domain and its resolving IP to deny‑list rules, monitor DNS queries for related workers.dev sub‑domains, and consider sinkholing or redirecting traffic to a safe landing page. Continuous threat‑intel feeds should be consulted for any emerging indicators, and endpoint controls should be updated to detect the observed malicious payload signatures.