proworkflow[.]ai

Analysis of proworkflow.ai indicates an active high-risk domain impersonating UPS, classified as a crypto scam. The domain was registered on September 29, 2025, through GoDaddy.com, LLC, and currently resolves to IP address 34.111.179.208, hosted on Google Cloud infrastructure (AS396982). The SSL certificate is issued by Let's Encrypt (serial E7), and the site returns an HTTP 200 status, suggesting operational availability. The page title, 'Pro Workflow - Streamline your professional workflow,' does not explicitly reference UPS, though the domain is confirmed to target the UPS brand based on threat intelligence sources.

Detection data reveals low trust scores, with Gridinsoft assigning a 0/100 trust rating. AlienVault OTX includes the domain in one threat intelligence pulse, while VirusTotal reports three security vendors flagging it as malicious. The domain appears on two security blocklists and is actively blocked by PhishDestroy and ScamSniffer. Infrastructure analysis shows the use of Node.js, Express, Google Cloud services (including Cloud Trace and CDN), HSTS, HTTP/3, and Calendly integration, which may be leveraged to enhance perceived legitimacy or facilitate fraudulent interactions.

While the domain is confirmed as a crypto scam, specific details about the operational mechanics—such as wallet addresses, lure tactics, or victim targeting—remain unconfirmed in available intelligence. Defenders should treat this domain as a confirmed threat, prioritizing blocking at the DNS and IP level, and monitoring for related indicators of compromise. Given its recent registration and active status, continued vigilance is recommended, particularly for organizations or users interacting with UPS-branded communications.