wild-term-78bb[.]trustcoin[.]workers[.]dev

This domain wild-term-78bb.trustcoin.workers.dev is assessed as high-risk brand impersonation infrastructure targeting ethereum, with observed malicious page content labeled 'GoMining'. The configuration indicates deceptive presentation designed to mislead users into associating the service with legitimate blockchain-related platforms, leveraging trust in established cryptocurrency ecosystems. The threat type is consistent with phishing-style credential or asset solicitation campaigns.

Technical indicators show VirusTotal detection at 9/95 security vendors flagging the domain, indicating moderate cross-engine consensus on malicious behavior. The infrastructure is hosted under Cloudflare Workers (AS13335 Cloudflare, Inc.) and resolves to IP 172.67.132.102. The domain uses SSL issued by Google Trust Services (WE1), suggesting encrypted transport despite malicious intent. Registration is through Cloudflare, Inc., with creation date March 14, 2026. The domain appears on 2 security blocklists and is actively blocked by PhishDestroy and ScamSniffer, reinforcing external validation of malicious classification.

The domain remains active at time of assessment, indicating ongoing exposure risk despite blocklist inclusion. Combined indicators—9/95 detection rate, dual blocklist presence, recent creation date (March 14, 2026), Cloudflare-hosted infrastructure, and impersonation of ethereum—suggest a coordinated phishing deployment using legitimate CDN and TLS services to enhance credibility. Mitigation should include DNS/IP-level blocking, continuous monitoring for related workers.dev subdomains, and user awareness controls to prevent credential entry or transaction signing on this endpoint. The presence of encrypted transport does not reduce risk and may increase user trust exploitation potential.