taostinworks[.]org

This domain, taostinworks.org, is flagged as an active high-risk phishing infrastructure targeting users with a fraudulent investment platform. Registered on September 19, 2025, through Gname.com Pte. Ltd., the site presents itself as a 'One-Stop Global Investment Platform' offering forex, commodities, stocks, indices, cryptocurrencies, gold, and oil trading, as indicated by its page title. The domain resolves to IP address 104.21.70.163 and is protected by Cloudflare, utilizing technologies such as Vue.js, RxJS, HSTS, and HTTP/3. The SSL certificate is issued by Google Trust Services, which does not inherently validate the site's legitimacy. Analysis indicates the domain appears on four security blocklists and has been included in 17 threat intelligence pulses on AlienVault OTX. It is currently blocked by multiple security mechanisms, including SEAL, MetaMask, PhishDestroy, and BLP-Malware, with a Gridinsoft trust score of 0/100. While no detections were reported by the 95 vendors that scanned the domain on VirusTotal, this absence does not confirm safety, as phishing infrastructure often evades initial detection. Defenders should treat this domain as malicious based on its presence on multiple blocklists, low trust scores, and association with known phishing indicators. The site's investment-themed content suggests it is likely designed to harvest credentials or financial details from victims. Immediate blocking at the network and endpoint levels is recommended, along with monitoring for related domains registered through the same registrar or resolving to the same IP infrastructure. Further investigation into the hosting provider and associated threat actor infrastructure may provide additional context for mitigation.