treasurypool-quantnetwork[.]xyz

The domain treasurypool-quantnetwork.xyz was registered on 2026-01-04 through NiceNIC International Group Co., Limited and resolved to the Cloudflare‑owned address 188.114.97.3 (AS13335, United States). No TLS certificate was presented, indicating the site was served over plain HTTP before being taken offline. The site’s HTML title advertised "Quant Treasury Pool — Rewards Distribution", a narrative consistent with a fake airdrop campaign that impersonates the Metamask wallet brand. Intelligence feeds have classified the operation as a brand‑impersonation airdrop scam targeting Metamask users. Multiple security services have already taken action: PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura list the domain as malicious, and it appears on five external blocklists.

VirusTotal scans recorded 14 detections out of 95 scanners, and Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The domain is also referenced in one AlienVault OTX pulse. The nameserver pair laura.ns.cloudflare.com and su... confirm the use of Cloudflare DNS. Because the site is currently offline, real‑time content analysis is not possible; the exact page markup, credential‑capture forms, or redirect behavior remain unknown.

However, the convergence of a brand‑targeted title, a known fake‑airdrop narrative, and multiple vendor detections provides sufficient confidence to treat the domain as a high‑risk phishing vector. Defenders should immediately block the IP 188.114.97.3 and add treasurypool-quantnetwork.xyz to URL filtering and email gateway deny lists. Monitoring for other domains that resolve to the same Cloudflare IP range or that reference the same page title can help catch copycat campaigns. Updating threat‑intel feeds with the observed indicators—registration date, registrar, nameservers, and detection counts—will improve early warning for future impersonation attempts against Metamask users.