allenfortlimited[.]ltd

The domain www.allenfortlimited.ltd is currently active and classified as a high‑risk brand‑impersonation campaign targeting Coinbase. The site returns an HTTP 307 redirect and presents a page titled "Bot Verification" under a Let’s Encrypt R12 certificate. The phishing kit in use has been identified as a Verification Scam, which is consistent with the observed page title.

Infrastructure analysis reveals that the domain resolves to the IPv4 address 198.251.89.220, which is advertised as belonging to AS53667 FranTech Solutions in the United States. The domain was registered on July 02, 2025 through Porkbun LLC and employs the authoritative nameservers ns27.asurahosting.com and ns28.asurahosting.com. The host operates a LiteSpeed web server with a Python/Django stack, and client‑side components include jQuery, Smartsupp, HSTS, and HTTP/3 support.

Detection signals indicate that the site is listed on a single security blocklist, carries a Gridinsoft trust score of 0/100, and has been blocked by the PhishDestroy service. VirusTotal reports a single positive detection out of 95 scanned security vendors, suggesting limited but concrete awareness of the malicious activity. The overall low detection density underscores the need for proactive monitoring, as the campaign may not yet be widely propagated.

Defenders should block the resolved IP address 198.251.89.220 and the domain www.allenfortlimited.ltd at perimeter defenses, update any URL filtering policies to include the full domain, and monitor for traffic to the associated nameservers. Continuous re‑evaluation of VirusTotal and blocklist status is advised, as additional detections may emerge. Given the verified impersonation of Coinbase, organizations handling cryptocurrency credentials should treat any outbound or inbound communications involving this domain as malicious and enforce strict authentication controls.