allocation-pump[.]xyz

The domain allocation-pump.xyz was reported as offline on 24 July 2026. Evidence shows the site presented a page titled “Pump” and was linked to a fake airdrop scheme that claimed to distribute rewards to Instagram users, indicating a brand‑impersonation tactic. Registration records reveal the domain was created on 15 September 2025 through NiceNIC International Group Co., Limited. DNS queries resolve the name to the Cloudflare address 104.21.57.181, which is assigned to AS13335 in the United States.

The authoritative nameservers are hugh.ns.cloudflare.com and nia.ns.cloudflare.com, and no SSL/TLS certificate was observed, meaning the service was reachable only via plain HTTP. VirusTotal scans reported five detections out of ninety‑five security vendors, confirming that multiple scanners identified the host as malicious. The domain appears on two security blocklists and has been actively blocked by the PhishDestroy and ScamSniffer services, providing additional confirmation of its malicious nature. Current intelligence does not include a full HTML capture or screenshot, so the precise content and any embedded payloads of the fake airdrop page remain unverified.

Defenders should block allocation-pump.xyz at DNS and web‑filter layers, add the IP address 104.21.57.181 to reputation‑based deny lists while recognizing the address is shared by many legitimate Cloudflare customers, and monitor for any re‑registration attempts or similar domain patterns that incorporate the word “pump” or reference Instagram airdrops. Because the campaign explicitly targets Instagram users, any inbound traffic, email links, or social‑media messages that reference airdrop incentives tied to Instagram should be treated as high‑confidence malicious activity. Continuous monitoring of brand‑specific threat feeds and updating intrusion‑detection signatures to include this indicator will help mitigate further exploitation.