intuitionpool[.]xyz

Analysis indicates that the domain intuitionpool.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited and immediately pointed to Cloudflare’s network, using the authoritative nameservers anuj.ns.cloudflare.com and suzanne.ns.cloudflare.com. DNS resolution returns the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented the HTTP response header “Just a moment…” as its page title, suggesting the use of Cloudflare’s interstitial challenge page rather than a legitimate landing page. The TLS certificate was issued by Google Trust Services under the WE1 designation, confirming that the connection was encrypted with a valid public‑trusted certificate.

Fingerprinting tools detected Cloudflare Browser Insights, Cloudflare services, and HTTP/3 support, all consistent with a typical Cloudflare‑protected hosting environment. Security‑vendor scans on VirusTotal show that five of ninety‑three AV engines flagged the domain, and the domain is currently listed on a single public blocklist. PhishDestroy has also added the domain to its blocklist, indicating that at least one dedicated anti‑phishing service has observed malicious activity. The five vendor detections reflect a moderate confidence level, indicating that static indicators such as the domain name, hosting IP, and SSL fingerprint have triggered at least some heuristic rules.

The campaign is classified as an investment scam, although the specific lure or targeted victim profile has not been disclosed in the available data. The domain is presently offline, which limits immediate observation of payloads or credential‑stealing pages. Consequently, the full extent of the malicious infrastructure, such as command‑and‑control servers or additional drop sites, remains uncertain.