gordon-allocation[.]xyz

The domain gordon-allocation.xyz was identified on July 23 2026 as an offline site that appears to be part of a brand‑impersonation operation aimed at Coinbase. The site presented the page title “$RICH PRE‑SALE”, which aligns with the reported scam type of brand impersonation. Registration data shows the domain was created on 5 September 2025 through NiceNIC International Group Co., Limited, and it is hosted on Cloudflare infrastructure (AS13335) with the IP address 104.21.93.135 located in the United States. No SSL certificate was observed, indicating the site served HTTP only before being taken offline. The domain resolves to the Cloudflare nameservers galilea.ns.cloudflare.com and vicente.ns.cloudflare.com. Detection telemetry indicates mixed vendor response: VirusTotal recorded 10 detections out of 95 scanning engines, and Gridinsoft assigned a trust score of 0 / 100.

AlienVault OTX references the domain in a single threat‑intelligence pulse. The domain is listed on two public blocklists, specifically PhishDestroy and ScamSniffer, confirming that multiple security‑vendor feeds have flagged it. No additional public reputation services were cited. Evidence gaps remain. The actual page content, login forms, or malicious payloads have not been captured, and the lack of an SSL certificate prevents verification of HTTPS‑only delivery.

Consequently, the full scope of the impersonation technique and any credential‑harvesting mechanisms cannot be confirmed at this time. Defenders should immediately block DNS resolution for gordon-allocation.xyz and add the associated IP 104.21.93.135 to network‑level deny lists. Monitoring of Cloudflare edge nodes for similar domains is advised, as the attacker appears to rely on shared hosting. Continuous ingestion of updates from the referenced blocklists and OTX pulse will help capture any re‑activation attempts.