wnbtreasurymanager[.]icu

Analysis of wnbtreasurymanager.icu indicates that the domain was registered on July 16, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolved to the IP address 172.67.220.170. The authoritative nameservers listed are joaquin.ns.cloudflare.com and lilyana.ns.cloudflare.com, suggesting the domain is hosted behind Cloudflare’s edge network. VirusTotal records show that the domain was scanned by 95 independent vendors, none of which returned a detection at the time of analysis; this absence of detections does not constitute confirmation of benign behavior. The site is presently listed on one external security blocklist and has been actively blocked by the PhishDestroy feed, reinforcing its classification as a malicious phishing resource. No public page title, SSL certificate details, or HTTP response codes have been disclosed, leaving the specific content and any targeted brand or credential‑harvesting mechanisms unverified. Given the short lifespan of the domain, its rapid deployment, and its association with known phishing mitigation feeds, defenders should treat the domain as hostile. Recommended actions include immediate DNS‑based blocking, inclusion in proxy and email gateway deny lists, and continuous monitoring for any DNS or TLS fingerprint changes that might indicate re‑hosting or repurposing. Threat‑intel teams should also query passive DNS and SSL observatories for any ancillary hostnames that resolve to the same IP range, as Cloudflare‑hosted infrastructure often serves multiple malicious payloads under a shared address space.