allocation-poly[.]info

This domain, allocation-poly.info, is actively serving a high-risk phishing operation targeting cryptocurrency users. Registered on March 2, 2026, through NiceNIC International Group Co., Limited, the domain currently resolves to 172.67.131.169, an IP address hosted by Cloudflare within AS13335. The site returns a 301 HTTP redirect, suggesting it may be funneling victims to a secondary malicious endpoint, while its page title mimics the legitimate allocation-poly.com, a common tactic to deceive users into believing they are interacting with a trusted platform. Analysis of the domain’s infrastructure reveals the use of Cloudflare nameservers (edna.ns.cloudflare.com and kevin.ns.cloudflare.com) and a Let’s Encrypt SSL certificate (serial E8), which provides a veneer of legitimacy. However, the domain is flagged on three security blocklists and has been explicitly blocked by at least three major security entities. VirusTotal reports that 3 out of 95 security vendors detect this domain as malicious, though this number may underrepresent its risk due to potential delays in vendor detection or reliance on older signatures. The Gridinsoft trust score of 0/100 further corroborates its classification as a confirmed threat. The exact phishing kit or lure in use remains unconfirmed, but the domain’s naming convention and observed behavior align with campaigns impersonating cryptocurrency platforms. Defenders should treat this domain as active and high-risk, particularly in environments where users may interact with digital asset services. Network-level blocks should be implemented immediately, and any associated credentials or wallet addresses linked to this domain should be flagged for monitoring. Given the domain’s recent registration and continued activity, it is likely part of an ongoing campaign rather than an isolated incident.