taostinworks[.]com

Analysis of the domain taostinworks.com indicates active participation in an investment scam operation, as classified by multiple threat intelligence sources. The domain, registered through Gname.com Pte. Ltd. on February 14, 2003, resolves to the IP address 172.67.137.228, which is associated with Cloudflare, Inc. (AS13335) in the United States. The domain's nameservers, anirban.ns.cloudflare.com and stevie.ns.cloudflare.com, further confirm its reliance on Cloudflare infrastructure. As of July 12, 2026, the domain remains active, returning an HTTP 200 status code and utilizing an SSL certificate issued by Google Trust Services (WE1). The page title, 'Taostinworks: One-Stop Global Investment Platform | Forex | Commodities | Stocks | Indices | Cryptocurrencies | Gold | Oil,' explicitly advertises financial services, aligning with the scam type labeled as an investment scam. This classification is supported by its inclusion in two AlienVault OTX threat intelligence pulses and its presence on three security blocklists, including PhishDestroy and MetaMask. Gridinsoft assigns the domain a trust score of 18 out of 100, reflecting a high level of suspicion. While the domain's registration date predates typical phishing campaigns, this does not diminish its current malicious activity. The use of Cloudflare infrastructure is consistent with tactics observed in other high-risk phishing operations, likely intended to obscure the true origin of the malicious content and evade detection. Defenders should treat this domain as a confirmed threat vector for financial fraud and implement blocking measures at the network and endpoint levels. Further investigation into associated infrastructure, such as related domains or IPs, may reveal additional components of this campaign.