allocatlon-suliend[.]mom

This domain, allocatlon-suliend.mom, is actively engaged in brand impersonation targeting Solend, a decentralized finance protocol. Analysis indicates the site is designed to deceive users into connecting cryptocurrency wallets under the pretense of legitimate Solend services, likely deploying a crypto drainer script to siphon funds. The page title 'Just a moment...' suggests the use of anti-bot or evasion techniques, common in infrastructure employed for credential harvesting and wallet exploitation. The threat is particularly insidious as it exploits trust in the Solend brand to facilitate unauthorized transactions, potentially leading to irreversible asset loss for victims. Infrastructure analysis reveals multiple elevated-risk indicators. The domain was registered on March 06, 2026, through NameSilo, LLC, a registrar frequently associated with malicious domains due to its low-cost and minimal verification processes. It resolves to the IP address 104.21.88.88, which is proxied through Cloudflare, a service often leveraged to obfuscate hosting origins and evade detection. The domain appears on one security blocklist and is flagged by 4 out of 95 security vendors on VirusTotal, including detections for phishing and malicious content. Technologies detected include Cloudflare and HTTP/3, the latter of which may be used to bypass traditional security controls by leveraging modern web protocols. Users who have visited allocatlon-suliend.mom or interacted with its content should take immediate action to mitigate potential compromise. First, disconnect any cryptocurrency wallets that were connected to the site and revoke any suspicious smart contract approvals using a blockchain explorer or wallet management tool. Monitor wallet activity for unauthorized transactions and transfer remaining assets to a new, secure wallet if compromise is suspected. Additionally, scan the device used to access the domain for malware, as crypto drainers often deploy secondary payloads. Report the domain to relevant security communities and consider notifying the impersonated brand, Solend, to aid in broader threat mitigation efforts. Given the elevated risk level, users should remain vigilant for follow-up phishing attempts via email or social media.