allocation-suilend[.]ws

The domain allocation-suilend.ws was registered on March 06, 2026 through NameSilo, LLC and is currently taken offline. DNS resolution points to the Cloudflare edge address 104.21.47.154, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative name servers are isla.ns.cloudflare.com and razvan.ns.cloudflare.com, indicating that the attacker relied on Cloudflare’s CDN and DNS services to hide the true origin of the site. No TLS certificate is presented for the domain, meaning HTTPS connections would be unavailable or would fall back to an insecure HTTP endpoint.

The page title observed during the brief live period was "Phase 2 Distribution," and the campaign is classified as a fake airdrop aimed at Discord users, suggesting an attempt to harvest credentials or tokens under the guise of a reward distribution. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple anti‑phishing solutions have identified it as malicious. Gridinsoft assigned a trust score of 0 / 100, reinforcing the assessment of high risk. VirusTotal recorded scans from 94 vendors, none of which currently flag the domain; this absence of detections does not constitute a safety indication and should be interpreted as a lack of consensus among scanners at the time of analysis.

Defenders should continue to block allocation-suilend.ws at network perimeter and DNS layers, monitor for any resurgence of the same infrastructure, and apply heuristic rules that detect Discord‑related airdrop language or similar page titles. Given the use of Cloudflare’s network, future iterations may employ new hostnames while retaining the same registrar and name‑server pattern, so watchlists should incorporate these attributes. The combination of a newly created domain, lack of TLS, low trust score, and presence on multiple blocklists makes allocation-suilend.