treasury-arkm[.]app

This domain, treasury-arkm.app, is flagged as an active generic phishing threat with high risk. Registered on March 26, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP address 104.21.40.87 and uses Cloudflare infrastructure with HTTP/3 and an SSL certificate from Google Trust Services. The page title displays a 523: Origin is unreachable error, indicating the origin server is not responding or is intentionally blocked, though the domain itself remains active. Threat intelligence from AlienVault OTX shows this domain appears in 23 threat pulses, and VirusTotal reports 13 of 95 security vendors flagging it as malicious. It is blocked by PhishDestroy and BLP-Malware and appears on two security blocklists, with a Gridinsoft trust score of 0/100. The domain name strongly suggests it impersonates the ARKM treasury or related platform, likely targeting users of the Arkham (ARKM) cryptocurrency ecosystem for credential theft or fund diversion. The exact page content has not been analysed due to the unreachable origin; defenders should block all traffic to this domain, monitor for associated subdomains or IP changes, and warn users against interacting with any communications referencing the ARKM treasury hosted at this address. Further investigation of the IP 104.21.40.87 and related Cloudflare edge services is recommended to identify other potentially malicious domains.