treasury-connect[.]xyz

Analysis of treasury-connect.xyz indicates active malicious use consistent with a generic phishing operation. The domain resolves to 76.223.54.146, an AWS Global Accelerator endpoint located in the United States, a pattern frequently observed in threat actor infrastructure. HTTP requests return a 200 status and the TLS certificate is issued by GoDaddy.com under the GoDaddy TLS Intermediate CA DV - R1v1 chain, confirming a valid but unrelated certificate. VirusTotal records show five of ninety‑one security vendors flagging the domain, suggesting partial detection. The domain appears on three public blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX references include three separate threat pulses referencing the same indicator. MX records contain an empty host entry, indicating no legitimate mail service. Nameservers are hosted by Afternic (ns5.afternic.com, ns6.afternic.com) with an additional verification record, and registration was performed through GMO Internet Group, Inc. d/b/a Onamae.com. Given the observed indicators—active hosting, HTTP 200 response, partial vendor detections, blocklist presence, and association with known phishing blocklists—defenders should block the domain at network perimeters, monitor DNS queries for the associated IP, and consider sinkholing or takedown actions where feasible. Continuous re‑evaluation is advised as additional telemetry becomes available.