treasury-spark[.]com

Analysis of the domain treasury-spark.com indicates it was registered on December 1, 2025, through Dynadot LLC and is currently offline, returning an HTTP 404 status. The domain resolves to the IP address 104.21.24.116, hosted on Cloudflare's infrastructure (AS13335) in the United States, with nameservers alexa.ns.cloudflare.com and randall.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for Cloudflare-protected domains. At the time of assessment, the domain appears on one security blocklist, PhishDestroy, and was flagged by 3 of 95 security vendors on VirusTotal, suggesting limited but present detection of malicious activity.

The page title, 'treasury-spark.com | 504: Gateway time-out,' does not provide explicit evidence of the phishing content or targeted brand, and no specific scam type or kit is identified in the available data. The domain's registration age (approximately seven months at the time of reporting) and use of Cloudflare for hosting are consistent with patterns observed in phishing campaigns, though such infrastructure is also used legitimately. The HTTP/3 protocol detection further aligns with modern web hosting practices and does not inherently indicate malicious intent. Defenders should note that the domain's current offline status limits further analysis of its active content or behavior.

However, the existing detections and blocklist presence warrant continued monitoring. Network-level protections, such as blocking the resolved IP (104.21.24.116) or implementing domain-based filtering, may mitigate potential risks if the domain reactivates. Given the limited vendor detections, automated threat intelligence feeds should be consulted for updates, particularly if the domain resumes activity. No concrete evidence links this domain to a specific brand or phishing kit, so generic phishing defenses are recommended until additional indicators emerge.