nillion-treasury[.]com

Analysis of nillion-treasury.com shows a recently registered domain (creation date November 20 2025) that has been taken offline but retains evidence of a phishing campaign. The domain is registered through NiceNIC International Group Co., Limited and uses Cloudflare’s authoritative name servers diva.ns.cloudflare.com and kaiser.ns.cloudflare.com. DNS resolution points to the IPv6 address 2606:4700:3032::6815:3dc2, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No TLS certificate is presented, indicating the site was served without HTTPS.

The page title returned from the last known HTTP response is “Nur einen Moment…”, a German phrase meaning “Just a moment…”, which is commonly employed by malicious sites to delay user interaction. Gridinsoft assigns a trust score of 0 / 100, the lowest possible rating, reinforcing the malicious nature of the domain. The domain appears on a single security blocklist, PhishDestroy, and VirusTotal reports that 5 of 95 scanned security vendors flagged the domain, providing additional corroboration of phishing activity. The domain’s current status is offline, limiting immediate payload delivery but leaving the infrastructure in place for potential re‑use.

Defenders should add nillion-treasury.com to network deny lists, block its IP address range (2606:4700:3032::/48) where feasible, and monitor for any future DNS changes or re‑activation. Continuous observation of Cloudflare‑hosted IPs associated with similar phishing titles is advised, as threat actors often rotate domains while retaining the same hosting provider. Because the site lacks an SSL certificate and is already listed on a phishing blocklist, any inbound connections to the domain should be treated as high‑confidence malicious traffic.