treasury-onbeam[.]com

This domain is flagged for elevated-risk brand impersonation targeting Google, a tactic commonly used to deceive users into divulging credentials or sensitive information under false pretenses. The infrastructure mimics legitimate services to exploit trust in the targeted brand, increasing the likelihood of successful social engineering attacks. Analysis indicates the domain was specifically designed to appear associated with Google, despite no official affiliation. Infrastructure analysis reveals the domain treasury-onbeam.com was registered on August 22, 2025, through Tucows Domains Inc. and is currently offline. It resolves to the IPv6 address 2606:4700:3037::6815:22a4 and is served via Cloudflare with HTTP/3 support. The SSL certificate is issued by Google Trust Services, which may lend an air of legitimacy to unsuspecting users. Security vendors on VirusTotal flagged the domain at a rate of 7/95, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist, specifically PhishDestroy, and presents a page title of "WanderSphere Blog," which does not align with the impersonated brand. Mitigation against brand impersonation threats requires a multi-layered approach. Network-level protections should block the domain and its resolving IP address across all security gateways. Security teams should monitor for SSL certificates issued by Google Trust Services that do not correspond to verified Google properties, as these may indicate fraudulent infrastructure. End-user education should emphasize verifying domain authenticity before entering credentials, particularly for domains registered within the past 90 days. Organizations should also implement DMARC, DKIM, and SPF policies to prevent email spoofing of the impersonated brand, reducing the risk of phishing campaigns leveraging similar domains.