allocation-valora[.]net

Analysis indicates the domain allocation-valora.net is an active phishing site targeting cryptocurrency users, first detected on July 19, 2026. Infrastructure analysis reveals the domain resolves to 188.114.97.3, a Cloudflare IP address located in Canada, which is consistent with bulletproof hosting patterns observed in recent phishing campaigns. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domains due to its lenient abuse policies. Current HTTP status returns 200, confirming the site is operational and serving content. Nameservers are hosted under Cloudflare (mckinley.ns.cloudflare.com, nitin.ns.cloudflare.com), a common tactic to obscure backend infrastructure and evade takedowns. Security vendors have flagged this domain, with 5 of 91 engines on VirusTotal detecting malicious activity, though the exact nature of the phishing kit or payload remains unconfirmed. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently indicate legitimacy but is often exploited to lend credibility to fraudulent sites. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, which specialize in cryptocurrency-related threats. This suggests the site is likely impersonating a crypto wallet or exchange, though the specific brand or service mimicked has not been identified in available data. Defenders should treat this domain as high-risk. Recommended actions include blocking the domain and IP at the network level, monitoring for internal connections to 188.114.97.3, and alerting users to potential cryptocurrency phishing attempts. Given the domain's active status and Cloudflare hosting, takedown efforts may face delays, necessitating proactive mitigation. Further analysis of the site's content and payload is advised to determine the exact phishing mechanism and targeted brands.