strszn-allocation[.]xyz

Analysis of the domain strszn-allocation.xyz confirms its classification as a high-risk phishing site targeting Coinbase users through a fraudulent airdrop scheme. The domain was registered on February 21, 2026, via NiceNIC International Group Co., Limited and currently resolves to the IP address 188.114.97.3, which is part of Cloudflare's network (AS13335). No SSL certificate is present, increasing the risk of unencrypted data transmission. Nameservers dylan.ns.cloudflare.com and elma.ns.cloudflare.com further indicate Cloudflare's infrastructure, commonly leveraged by threat actors to obfuscate hosting origins.

Security vendor detections on VirusTotal report 14 of 93 engines flagging the domain as malicious, while it appears on four independent security blocklists. The page title, $StrSzn DISTRIBUTION, aligns with the reported scam type—a fake airdrop—likely designed to deceive users into connecting wallets or submitting credentials under the guise of a token distribution. The domain is actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL, corroborating its malicious intent. As of July 23, 2026, the site is offline, though defenders should treat it as a confirmed threat due to its prior activity and detection history.

The absence of an SSL certificate and reliance on Cloudflare infrastructure are consistent with phishing campaigns seeking to evade takedowns. Defenders are advised to block the domain and IP at network and endpoint levels, monitor for related infrastructure (e.g., other domains using the same registrar or nameservers), and alert users to the fake airdrop scam targeting Coinbase. Further investigation into the registrar's role in domain registration patterns may reveal additional malicious domains.