claim[.]scroll-allocation[.]xyz

This domain (claim.scroll-allocation.xyz) was registered on 5 Nov 2024 through PDR Ltd. d/b/a PublicDomainRegistry.com. The authoritative nameservers are desi.ns.cloudflare.com and venkat.ns.cloudflare.com, indicating Cloudflare DNS services. DNS resolution returns a single IPv4 address 104.21.96.1, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented; the site serves HTTP only, which aligns with the lack of an SSL certificate in the observed data. The page title returned by the server is “Nur einen Moment…”, a German phrase meaning “Just a moment…”, and no further content has been captured because the service is currently offline.

VirusTotal has recorded six detections out of ninety‑five scanners, confirming that multiple security engines flag the domain as malicious. Scamadviser assigns a trust score of 20 out of 100, reflecting a low reputation. The domain appears on one public blocklist and is actively blocked by the PhishDestroy community feed. The listed scam type is “Crypto Scam”, and the brand target is identified as Scroll, suggesting an attempt to lure victims into a fraudulent transaction or credential harvest related to that service.

The available evidence points to a typical brand‑impersonation infrastructure that leverages Cloudflare’s edge network to hide the origin server. Because the site is presently taken offline, live‑traffic analysis is not possible, and the exact payload or credential‑capture mechanism remains unknown. Defenders should continue to block the domain and its resolving IP at perimeter defenses, monitor for any resurgence of the host, and add the domain to internal watchlists. Threat‑intel teams should also correlate any future sightings of the 104.21.96.1 address with other malicious campaigns, given its association with known phishing infrastructure.