robo-allocations[.]xyz

Analysis of the domain robo-allocations.xyz indicates it was actively flagged as a generic phishing threat prior to being taken offline on or before July 24, 2026. The domain was registered on March 6, 2026, through NiceNIC International Group Co., Limited, and resolved to the IP address 172.67.200.137, hosted on Cloudflare's infrastructure (AS13335). The nameservers merlin.ns.cloudflare.com and nancy.ns.cloudflare.com further confirm Cloudflare as the DNS provider. No SSL certificate was detected, increasing the likelihood of unencrypted communications between victims and the malicious endpoint.

The page title 'ROBO | Distribution' suggests the site impersonated a distribution or allocation portal associated with a service or product branded as 'ROBO,' though no specific legitimate brand has been confirmed as the target. The domain appeared on four security blocklists and was blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL, indicating broad recognition of its malicious nature within the security community. One of 94 security vendors on VirusTotal flagged the domain, though the absence of additional detections does not diminish the credibility of the confirmed alerts. Infrastructure analysis reveals reliance on Cloudflare, a common tactic to obscure hosting origins and evade IP-based blocking.

The domain's registration with NiceNIC, a registrar frequently associated with low-cost and short-lived malicious domains, aligns with patterns observed in phishing campaigns. Defenders should treat this domain as a confirmed phishing endpoint and prioritize blocking both the domain and its resolved IP (172.67.200.137) at the network level. Monitoring for newly registered domains with similar naming conventions (e.g., 'robo-*' or 'allocation-*') under the same registrar or hosting provider may help preemptively identify related threats.