asterczs-allocation[.]xyz

Analysis of the domain asterczs-allocation.xyz indicates it was actively involved in phishing operations as of July 23, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently observed in phishing infrastructure. It resolved to the IP address 188.114.97.3, which is part of Cloudflare's network (AS13335) and geolocated in the United States. The domain's nameservers, jo.ns.cloudflare.com and tim.ns.cloudflare.com, further confirm its reliance on Cloudflare's DNS and proxy services. The SSL certificate issued to the domain was provided by Google Trust Services (WE1), a common certificate authority for both legitimate and malicious sites.

Technologies detected on the domain include Cloudflare, Cloudflare Browser Insights, and HTTP/3, all consistent with modern web infrastructure but also commonly exploited by threat actors to obfuscate malicious activity. The page title captured during analysis was 'Just a moment...', a generic placeholder often associated with Cloudflare's interstitial pages, which may indicate the site was either in the process of loading malicious content or was configured to evade automated detection. As of the report date, the domain has been taken offline, though its prior status suggests it was operational long enough to be flagged by multiple security vendors. Seven out of 93 security vendors on VirusTotal classified the domain as malicious, and it appears on at least two security blocklists, including PhishDestroy and ScamSniffer. The elevated risk classification is supported by these detections, though the exact nature of the phishing campaign—such as the targeted brand or specific scam type—remains unconfirmed due to the lack of detailed page content analysis.

Defenders should treat this domain as part of a broader phishing infrastructure, particularly given its use of Cloudflare's services to mask its true hosting origin.