treasurypool-palmai[.]com

Analysis shows that treasurypool-palmai.com was registered on June 12, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. The domain resolves to Cloudflare IP 104.21.27.76 (CA) and uses the nameservers keaton.ns.cloudflare.com and oaklyn.ns.cloudflare.com. An HTTPS connection is presented with a Google Trust Services / WE1 certificate, indicating a valid TLS chain but offering no assurance of legitimacy. HTTP requests return a 301 redirect, and the page title observed is "PaLM AI - $PALM," suggesting an attempt to impersonate the PaLM AI brand or related token offering. VirusTotal scans flagged the domain by 2 of 91 security vendors, and the site appears on three external blocklists. Defensive security products PhishDestroy, MetaMask, and SEAL have already blocked the domain. Gridinsoft assigns a trust score of 0/100, reinforcing the malicious assessment. The infrastructure is typical of opportunistic phishing operations that leverage Cloudflare’s CDN to obscure origin. No additional payload or content details have been disclosed, and the exact phishing vector remains unverified. Defenders should continue to block the domain at network and endpoint layers, monitor DNS queries for the associated IP and name servers, and update detection rules to capture the observed 301 redirect pattern and page title fingerprint. Further sandbox analysis of the site’s final landing page is recommended to determine any credential harvesting or malware delivery mechanisms.