connect-cnbs[.]black-37a[.]workers[.]dev

The domain connect-cnbs.black-37a.workers.dev was observed hosting a crypto‑related brand‑impersonation campaign targeting Gmail users. Infrastructure analysis shows the domain is served via Cloudflare Workers and resolves to the IPv6 address 2a00:1450:4001:810::2004, which belongs to AS15169 (Google LLC) in Germany. The service presents HSTS, Cloudflare, and HTTP/3 support, and presents a valid SSL certificate issued by Google Trust Services under the WE1 label. An HTTP request returns status code 403, indicating that the site is currently inaccessible; the domain’s status is recorded as offline.

Reputation data indicate the domain appears on a single security blocklist and has been blocked by PhishDestroy. VirusTotal scanning recorded 11 detections out of 95 vendors, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious assessment. The page title returned is "Google," and the brand target is identified as Gmail, confirming the impersonation intent. The scam type is classified as a crypto scam, though the exact payload or monetary mechanism has not been disclosed.

No nameserver information is available, and no further page content has been captured. Defenders should immediately block the domain at network perimeters, update URL filtering rules, and monitor for other Cloudflare‑Workers‑based domains that resolve to Google‑owned IP ranges but exhibit similar threat indicators. Continuous threat‑intel feeds should be consulted for any resurgence, and incident response teams should treat any related traffic as potentially malicious, especially when paired with Gmail‑related credential‑harvesting attempts.