allocation-tronares[.]com

The domain allocation-tronares.com was registered on 16 Oct 2025 through Name SRS AB and is currently hosted behind Cloudflare (AS13335) with the A record 172.67.194.25. The authoritative nameservers are louis.ns.cloudflare.com and veronica.ns.cloudflare.com. No TLS certificate was observed, indicating the site served only HTTP. The only visible HTML element is the page title “Just a moment…”, which provides no functional clues about the payload.

Intelligence classifies the site as a crypto-scam phishing operation. VirusTotal scans returned six positive detections out of ninety‑five AV engines, and Gridinsoft assigned a trust score of zero out of one hundred, reflecting a high confidence of malicious intent. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service. The site is presently taken offline, limiting immediate exposure but preserving the underlying infrastructure for potential reuse.

Defenders should add the IP address 172.67.194.25 and the domain name to inbound and outbound filtering rules, monitor for any future DNS resolution changes, and verify that any client‑side scripts that may have been delivered prior to takedown are removed. Continued observation of Cloudflare‑hosted assets associated with the same nameservers is advised, as threat actors often recycle infrastructure. Attribution beyond the registrar and hosting details remains uncertain; no additional malware kits, command‑and‑control endpoints, or victim data exfiltration evidence have been published. Organizations should treat this indicator as high‑confidence evidence of a crypto‑scam phishing campaign and incorporate it into threat‑intel feeds and endpoint detection policies.