taostinworks[.]cc

This domain is currently active and hosts a site whose title advertises a global investment platform covering forex, commodities, stocks, indices, cryptocurrencies, gold and oil. The domain taostinworks.cc was registered on 19 September 2025 through Gname.com Pte. Ltd. and resolves to the Cloudflare‑served address 188.114.97.3, ASN 13335. The site presents a valid SSL certificate issued by Google Trust Services under the WE1 trust chain, indicating proper TLS termination via Cloudflare. Nameservers anirban.ns.cloudflare.com and stevie.ns.cloudflare.com confirm the use of Cloudflare DNS. An HTTP request returns status 200, showing the web service is reachable. Infrastructure analysis shows the domain is listed on three public security blocklists and is explicitly blocked by PhishDestroy, MetaMask and SEAL, suggesting that multiple threat‑intelligence feeds have identified it as malicious. AlienVault OTX references a single pulse that includes taostinworks.cc, and VirusTotal reports three of ninety‑one scanners flagging the domain, reinforcing the suspicion. The Gridinsoft trust score of 0/100 further indicates a poor reputation. The available evidence points to a high‑risk, investment‑focused phishing campaign. However, the content of the landing page has not been inspected, so the exact tactics remain unknown. Defenders should immediately block the domain at perimeter and DNS layers, monitor for outbound connections to the associated IP, and consider sinkholing the address to disrupt further activity. Ongoing telemetry should be collected to detect any evolution of the campaign.