treasury-zama[.]xyz

Analysis of treasury-zama.xyz as of August 06, 2026 indicates that the domain is currently active and classified as a generic phishing threat with an elevated risk rating. The domain appears on one security blocklist and is actively blocked by the PhishDestroy service, showing that a recognized anti‑phishing feed has flagged it as malicious. VirusTotal has scanned the domain and three of ninety‑one security vendors returned a positive detection, confirming that independent scanning engines have observed suspicious activity associated with the host.

DNS resolution points to the IPv4 address 172.67.175.36, an address commonly associated with cloud‑based hosting providers that can be used to obscure the true origin of malicious infrastructure. No registrar details, SSL certificate information, HTTP status codes, or page‑title data are present in the available intelligence, leaving the underlying hosting arrangement, certificate legitimacy, and exact content of the site unverified. Consequently, the specific lure or brand impersonated by the site cannot be confirmed at this time.

Defenders should add treasury-zama.xyz to outbound filtering and DNS‑blocking policies, monitor network traffic for connections to 172.67.175.36, and ensure that existing security products that reference the blocklist are updated. Regular re‑scanning with multi‑engine services such as VirusTotal is recommended to detect any changes in detection counts, and any observed phishing emails or payloads should be shared with threat‑intel communities to improve collective detection capabilities.