treas-spx-6900[.]com

The domain treas-spx-6900.com is currently flagged as an active high-risk phishing resource targeting users of TreasuryDirect, a U.S. government savings bond and securities platform. Analysis indicates this domain is designed to harvest credentials or financial information under the guise of official Treasury services. The threat type is classified as generic_phishing with confirmed impersonation of a government financial portal. Infrastructure analysis reveals the domain was registered on June 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 172.67.187.168 and is secured with an SSL certificate issued by Google Trust Services, a tactic commonly employed to lend false legitimacy. As of the latest assessment, the domain is detected by 3 of 95 security vendors on VirusTotal and appears on 2 distinct security blocklists. Protective measures have been implemented by multiple threat intelligence platforms, including confirmed blocks by at least two widely recognized security frameworks. The domain remains active and continues to pose a significant risk to users attempting to access legitimate TreasuryDirect services. Organizations and individuals are advised to block traffic to 172.67.187.168 and treas-spx-6900.com at the network perimeter. Endpoint protection systems should be updated to include this domain in real-time phishing filters. Users should be educated to verify domain authenticity before entering credentials and to report any suspicious login prompts associated with TreasuryDirect or similar financial platforms.