treasury-zinc[.]cash

treasury-zinc.cash is a newly detected phishing domain that targets MetaMask users. Despite having zero detections on VirusTotal, it is already listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL. This domain exploits the critical 24-72 hour window between its registration and the time it appears in antivirus databases, allowing it to operate under the radar of most security systems.

Registered with PDR Ltd. d/b/a PublicDomainRegistry.com, the domain is hosted on an IP address managed by Cloudflare, Inc., located in the United States. The SSL certificate is issued by Google Trust Services, adding a layer of perceived legitimacy to the site. The page title simply reads "ZINC," which may be an attempt to obfuscate its true intent or to lure unsuspecting users into a false sense of security.

PhishDestroy's early detection pipeline identified treasury-zinc.cash on June 21, 2026, just one day after its creation. This rapid identification underscores the effectiveness of PhishDestroy's monitoring capabilities in catching threats before they propagate through traditional antivirus channels. With a platform risk score of 80 out of 100, this domain represents a significant threat to users, particularly those involved with cryptocurrency and MetaMask. The presence of this domain on multiple blocklists further highlights its malicious nature and the need for immediate awareness among potential targets.