treasurypool-plasma[.]app

This domain, treasurypool-plasma.app, is flagged as an active high-risk investment scam phishing site. Registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, it resolves to IP address 188.114.96.3, which is associated with CloudFlare, Inc. in Canada. The domain is protected by Cloudflare nameservers (donald.ns.cloudflare.com and etta.ns.cloudflare.com) and uses an SSL certificate from Google Trust Services. The page title observed is 'Just a moment...', and the server returns an HTTP 403 status, indicating access is restricted. VirusTotal reports 7 out of 94 security vendors flagging this domain as malicious. It appears on one security blocklist, specifically PhishDestroy. AlienVault OTX shows the domain is present in 8 threat intelligence pulses. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of a high-risk entity. Defenders should block this domain at the network and email gateway levels to prevent user interaction. Since the site content is behind a 403 response, the exact phishing payload or landing page cannot be confirmed, but the combination of recent registration, low trust score, and multi-source threat intelligence signals strongly indicate malicious intent. No additional brand, kit, or vendor details were available in the analysis data.