rew-pool[.]xyz

The domain rew-pool.xyz was registered on October 24, 2025 through NiceNIC International Group Co., Limited and is currently offline. Technical analysis shows it resolves to the IP address 198.18.31.66 and uses the generic parking nameservers ns1.dns-parking.com and ns2.dns-parking.com. No SSL certificate is present, and an HTTP request returns a 522: Connection timed out page title, indicating the server is not responding to client connections. The domain has been flagged by PhishDestroy and appears on one public security blocklist.

Gridinsoft assigns it a trust score of 0 / 100, reflecting a high confidence of malicious intent. VirusTotal scans report that six of ninety‑five AV engines label the domain as malicious, reinforcing the suspicion. The listed scam type is an investment scam, suggesting the site was intended to lure victims with fraudulent financial promises. Because the site is offline, direct payloads cannot be captured, and the exact content of the landing page remains unverified.

Defenders should block the domain at network perimeters, add the associated IP address to deny‑lists, and monitor for any future re‑registration or reuse of the same infrastructure. Continuous observation of the registrar NiceNIC and the parking nameservers is advised, as malicious actors often recycle similar resources. Threat intelligence feeds should be updated to include rew-pool.xyz, and any incidental traffic should be logged for further forensic correlation.