purch-allocations[.]xyz

Analysis of purch-allocations.xyz indicates that the domain was actively used to host a fraudulent airdrop campaign targeting Coinbase users before being taken offline. The site was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare IP address 172.67.213.30, which is associated with AS13335 Cloudflare, Inc. in the United States. The domain is served by the Cloudflare nameservers ainsley.ns.cloudflare.com and alan.ns.cloudflare.com, and it does not present an SSL certificate, leaving the connection unencrypted. The page title returned by the HTTP response is "$PURCH DISTRIBUTION," which aligns with the reported scam type of a fake airdrop.

The infrastructure has been flagged by four independent blocklists, and it is listed as blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious nature of the site. VirusTotal scans show that seven of ninety‑five security vendors flagged the domain, providing additional corroboration of its nefarious use. The domain explicitly impersonates Coinbase, as indicated by the known intelligence, and the airdrop narrative is consistent with typical brand‑impersonation campaigns that lure victims into providing credentials or private keys.

While the site is currently offline, the historical data suggests that the domain was part of a broader phishing infrastructure targeting cryptocurrency users. Defenders should continue to monitor the IP address and associated Cloudflare nameservers for any resurgence of activity, enforce blocklist entries across perimeter defenses, and advise users to avoid unsolicited airdrop offers that reference Coinbase. Additional investigation of related domains registered through the same registrar may reveal further components of the campaign.