cancer-allocation[.]xyz

The domain cancer-allocation.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is served by Cloudflare nameservers leonidas.ns.cloudflare.com and savanna.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents an SSL certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS configuration, and the HTTP response includes HSTS and HTTP/3 headers, confirming the use of modern security protocols. VirusTotal has recorded nine positive detections out of ninety‑five scanned engines, and the domain appears on a single external blocklist.

PhishDestroy has already blocked the host, and Gridinsoft assigns it a trust score of 0 / 100, reflecting the highest level of suspicion. The page title retrieved from the site is “$CANCER DISTRIBUTION”, but the full page content has not been captured, so the exact visual or functional elements remain unknown. The intelligence indicates the site is being used for a “Fake Airdrop” campaign that impersonates Coinbase, a well‑known cryptocurrency exchange. No additional evidence of credential‑stealing pages or malicious payloads has been observed, but the combination of brand impersonation, low trust score, multiple vendor detections, and active blocklist listings strongly suggests a malicious intent aimed at luring users with fraudulent cryptocurrency rewards.

Defenders should continue to monitor the domain for any re‑appearance, enforce blocklist rules in perimeter security devices, and add the host to URL filtering policies that target Coinbase‑related phishing. Incident response teams should also flag any traffic to 188.114.97.3 as suspicious and consider isolating it pending further analysis. Because the site is currently offline, remediation actions are limited to preventive measures and intelligence sharing with industry peers.