treasury-compoundlabs[.]com

This domain, treasury-compoundlabs.com, was identified as a brand impersonation threat targeting Compound, a known decentralized finance protocol. Registered on February 21, 2026, the domain resolved to 104.21.80.1, an IP address associated with Cloudflare, Inc. (AS13335) in the United States. Infrastructure analysis reveals the use of non-standard nameservers, including 2-nest.pipe.ma, 1-ceci.njalla.do, and 3-pas.njalla.in, which may indicate an attempt to obscure ownership or hosting relationships. The domain is currently offline, as of the report date of July 24, 2026, and holds a trust score of 0/100 from Gridinsoft, reflecting its high-risk classification.

Security vendor detections confirm its malicious status: 16 of 93 security vendors on VirusTotal flagged the domain, and it appears on two security blocklists. Additionally, it is blocked by PhishDestroy and ScamSniffer, further validating its use in phishing operations. The SSL certificate is issued by WE1, a provider commonly observed in low-reputation or short-lived domains.

While the exact content of the site remains unanalyzed, the domain’s structure and naming convention strongly suggest an intent to deceive users into believing it is affiliated with Compound. Defenders should treat this domain as confirmed malicious infrastructure and ensure it is blocked at the network and endpoint levels. Given its offline status, monitoring for reactivation or related domains with similar naming patterns is recommended.