treasury-superverse[.]com

Analysis of treasury-superverse.com indicates that the domain was registered on 2025-12-01 through Dynadot LLC and is currently taken offline. DNS resolution points to the IP address 104.21.51.194, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The authoritative nameservers are alexa.ns.cloudflare.com and randall.ns.cloudflare.com, confirming Cloudflare as the CDN provider. The site presented an HTTP 404 response and the page title reported a "504: Gateway time-out", suggesting that the web service was unavailable at the time of observation.

TLS negotiation succeeded using a certificate issued by Google Trust Services / WE1, a certificate chain commonly deployed by Cloudflare for default HTTPS. Threat-intelligence feeds show that the domain appears on a single security blocklist and is specifically listed by PhishDestroy. VirusTotal scans returned six positive detections out of ninety-five antivirus engines, reinforcing the malicious assessment. AlienVault OTX records the domain in one pulse, providing additional corroboration.

No additional context such as the targeted brand or phishing kit is disclosed, and the offline status prevents direct content analysis, leaving the exact payload or credential-collection mechanism unknown. Given the combination of recent registration, Cloudflare hosting, positive detections, and inclusion in multiple threat-intel sources, defenders should treat treasury-superverse.com as malicious. Recommended mitigation steps include adding the domain to web-filter deny lists, blocking outbound DNS queries for the associated IP address, and monitoring for newly registered domains that resolve to the same Cloudflare IP range or use the same registrar. Continuous ingestion of updated blocklists and VirusTotal feeds will help capture any re-emergence of the domain or related infrastructure.