aethir[.]allocationchecker[.]xyz

The domain aethir.allocationchecker.xyz was first observed on March 12, 2026 when it was registered through HOSTINGER operations, UAB. Passive DNS shows the domain resolving to 84.32.84.84, an address allocated to AS47583 Hostinger International Limited in Lithuania. The authoritative name servers are ns1.dns-parking.com and ns2.dns-parking.com, both typical of parking services used by low‑cost registrars. The site was listed on three public phishing blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, indicating that multiple threat‑intel feeds have correlated the domain with malicious activity.

A single vendor on VirusTotal flagged the domain, suggesting at least one security product identified it as suspicious. The page title returned by the HTTP response is “aethir.allocationchecker.xyz/”, and no TLS certificate was presented, confirming that the service operated without encryption. Technical fingerprinting detected the use of Cloudflare, jsDelivr, Hostinger CDN, crypto‑js, cdnjs, and HTTP/3, a combination commonly observed in opportunistic crypto‑scam campaigns that load third‑party JavaScript libraries to obfuscate payloads. The current HTTP status is offline, so content cannot be retrieved for deeper analysis; consequently, the exact phishing lure, credential‑collection form, or malicious script has not been captured.

The lack of a valid SSL certificate and the reliance on generic hosting infrastructure increase the likelihood that the domain was a disposable drop‑site used for a short‑lived campaign. Defenders should add the domain and its resolving IP to block lists, enforce DNS sinkholing for the associated name servers, and monitor for new allocations from the same registrar or ASN that exhibit similar technology stacks. Continuous re‑query of the IP address is recommended, as Hostinger‑hosted infrastructure is frequently reused for related scams.