allocation-slerf[.]lol

Allocation-slerf.lol was registered on 18 October 2025 through NiceNIC International Group Co., Limited. The domain resolves to 172.67.195.179, an address owned by AS13335 Cloudflare, Inc. located in the United States. DNS records show the authoritative nameservers leah.ns.cloudflare.com and vicente.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. No TLS certificate was observed; the HTTPS endpoint returns no certificate, which is consistent with the current offline status.

Threat‑intelligence feeds list the domain on two blocklists, specifically PhishDestroy and ScamSniffer, and VirusTotal reports six detections out of ninety‑five scanned engines. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the low reputation. The HTTP response contains the title “Just a moment…”, but no further page content has been captured, leaving the exact phishing lure undefined. The evidence suggests that allocation‑slerf.lol is being leveraged for a generic phishing campaign, likely intended to redirect victims to a malicious landing page before the infrastructure is taken down.

Because the site is presently offline, active probing is limited to passive DNS and blocklist observations. Defenders should add the domain and its resolving IP to local blocklists, monitor the associated Cloudflare nameservers for re‑registration, and consider expanding heuristic rules to flag similar short‑lived .lol registrations. Continuous re‑scanning on VirusTotal or comparable platforms is recommended to capture any future payload changes. Until the site reappears, the immediate risk is mitigated, but the observed infrastructure indicates a reusable pattern that may be repurposed for future phishing operations.