mtpallocation[.]xyz

Analysis of mtpallocation.xyz shows a newly registered domain (created March 27, 2026) that is currently active and serves a page titled "Just a moment...". The site resolves to IP 188.114.96.3, hosted behind Cloudflare infrastructure with the IP location listed as Canada (CloudFlare, Inc.). DNS is delegated to emerson.ns.cloudflare.com and nelly.ns.cloudflare.com, indicating the use of Cloudflare's DNS services. The domain presents an HTTPS certificate issued by Google Trust Services under the WE1 designation, but the HTTP response returns a 403 status code, suggesting intentional access restriction. Reputation data includes a Gridinsoft trust score of 0/100 and placement on a single security blocklist, with PhishDestroy explicitly blocking the domain. VirusTotal scans have flagged the domain by 7 of 94 vendors, and AlienVault OTX references it in one threat intelligence pulse. Registration details list NICENIC INTERNATIONAL GROUP CO., LIMITED as the registrar. The combined indicators—low trust score, blocklist presence, multiple vendor detections, and classification as a "Crypto Drainer" scam—support a high‑risk assessment. While the exact payload or phishing flow has not been observed directly, the available evidence justifies treating mtpallocation.xyz as a malicious actor. Defenders should block the domain at network perimeters, incorporate its indicators into threat‑intel feeds, and monitor for any outbound connections to the associated IP address. Continuous re‑evaluation is advised as additional telemetry becomes available.