allocation-kinetiq[.]app

Analysis of allocation-kinetiq.app, observed on July 25 2026, shows that the domain resolves to 172.67.130.160, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The domain is delegated to the Cloudflare nameservers adam.ns.cloudflare.com and danica.ns.cloudflare.com, and it lacks an SSL/TLS certificate, causing HTTPS connections to fail or be intercepted by Cloudflare's default challenge page, which presents the title “Just a moment…”. Registration data indicate that the domain was created on 26 February 2026 through NiceNIC International Group Co., Limited. VirusTotal scans have recorded detections from three of ninety‑three security vendors, and the domain is listed on three external blocklists.

Independent blocking services including PhishDestroy, MetaMask, and SEAL have also flagged the site. The current hosting status is reported as offline, suggesting the phishing infrastructure has been taken down or is temporarily unavailable. The convergence of Cloudflare hosting, lack of a valid certificate, a generic challenge page title, and multiple vendor detections aligns with known patterns of generic phishing campaigns that use fast‑flux or CDN services to hide attacker infrastructure. However, without a live payload or content analysis, the specific phishing template, targeted brand, or credential‑harvesting mechanism remains unknown.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for re‑activation of the same host or similar Cloudflare‑hosted domains, and consider adding the IP address 172.67.130.160 to threat‑intel feeds. Ongoing reconnaissance of the registrar NiceNIC International Group Co., Limited may reveal additional domains registered in the same window. Organizations should remain vigilant for emails or messages that reference the domain name, even though the site appears offline, as attackers may redeploy the infrastructure under a new address.