treasury-plasma[.]app

This domain, treasury-plasma.app, is flagged as an active phishing threat. Registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, it currently resolves to 188.114.97.3, an IP address associated with Cloudflare's infrastructure in Canada. The domain is served by Cloudflare nameservers (donald.ns.cloudflare.com, etta.ns.cloudflare.com) and presents a 301 HTTP status redirect, though the final destination remains unconfirmed. The page title 'Just a moment...' is consistent with Cloudflare's interstitial or challenge pages, which may obscure malicious content from automated scans. Analysis indicates the domain is blocked by at least one security vendor and appears on one public blocklist. Eight threat intelligence pulses in AlienVault OTX reference this domain, suggesting prior malicious activity. Seven of 94 security vendors on VirusTotal have flagged the domain, though the specific detection context is not detailed. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority for both legitimate and malicious sites. Defenders should treat this domain as high-risk due to its Cloudflare-hosted infrastructure, known phishing classification, and presence on security blocklists. The 301 redirect may indicate an attempt to evade detection or funnel traffic to a secondary malicious endpoint. No brand or scam type is confirmed from the available data, so the exact phishing target remains unanalyzed. Recommended actions include blocking the domain and IP at the network level, monitoring for connections to 188.114.97.3, and reviewing logs for any prior interactions with this infrastructure. Further investigation into the redirect chain is advised to identify the final malicious payload or destination.