charlie-allocation[.]xyz

This domain, charlie-allocation.xyz, poses a high-risk brand impersonation threat targeting users of the cryptocurrency exchange Coinbase. The site presents itself as a $KIRK PRE-SALE, a fraudulent cryptocurrency offering designed to deceive victims into transferring funds under the guise of an exclusive investment opportunity. Analysis indicates this is a classic advance-fee scam, where attackers exploit the reputation of a trusted brand to lure users into disclosing credentials or sending cryptocurrency to attacker-controlled wallets. The use of a pre-sale narrative increases urgency, pressuring victims to act quickly without verifying the legitimacy of the offer. Evidence supporting this assessment includes multiple technical indicators. The domain is flagged by 5 out of 95 security vendors on VirusTotal, indicating detection by a minority but notable portion of the security community. It was registered on September 12, 2025, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious infrastructure. The domain appears on one security blocklist, suggesting emerging recognition of its fraudulent nature. Infrastructure analysis reveals the domain resolves to the IP address 104.21.42.183, hosted on AS13335 Cloudflare, Inc., a network commonly used to obfuscate the true origin of malicious sites. Additionally, the absence of an SSL certificate further signals poor operational security practices, increasing the likelihood of malicious intent. Users who have visited charlie-allocation.xyz or interacted with its content should take immediate action to mitigate potential risks. First, cease all communication with the site and avoid clicking any links or downloading files from it. If cryptocurrency was transferred, report the transaction to the relevant exchange and local law enforcement, as recovery may be possible in some cases. Monitor financial accounts and cryptocurrency wallets for unauthorized activity, and consider revoking access to any connected applications or browser extensions. Reset passwords for Coinbase and any other accounts where credentials may have been reused, prioritizing the use of multi-factor authentication. Finally, scan the device used to access the site for malware, as phishing pages may deploy additional payloads to maintain persistence or exfiltrate data.