renzopoolpad[.]xyz

On 24 July 2026, the domain renzopoolpad.xyz was observed as part of an elevated‑risk brand‑impersonation campaign targeting the Renzo brand. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare edge address 172.67.205.76, which is associated with AS13335 (Cloudflare, Inc.) in the United States. DNS resolution is delegated to the Cloudflare authoritative nameservers karina.ns.cloudflare.com and pablo.ns.cloudflare.com, and the site employed Cloudflare Browser Insights, HTTP/3, and the default Cloudflare TLS termination using a Google Trust Services / WE1 certificate. A passive scan of the site returned the HTTP title “Just a moment…”, but the service has since been taken offline.

VirusTotal recorded five positive detections out of ninety‑three scanners, indicating that multiple security vendors have flagged the domain as malicious. The domain is listed on a single security blocklist and is specifically blocked by the PhishDestroy feed, confirming that threat‑intel aggregators have identified it as part of an investment‑scam operation. The campaign claims to impersonate Renzo, although no further content has been captured to verify the exact lure or credential‑harvesting mechanisms.

Because the infrastructure relies on Cloudflare’s shared network, attribution to a persistent operator is limited; however, the rapid registration date, use of a brand‑specific domain, and alignment with known investment‑scam patterns suggest a opportunistic abuse of the Renzo brand. Defenders should continue to monitor DNS queries for renzopoolpad.xyz and related Cloudflare IP ranges, enforce blocklist rules that include the domain and its IP, and consider adding the domain to internal URL filtering policies. Additional analysis of any cached page snapshots or traffic logs may reveal the phishing kit or payload used, which could aid in attributing the actor and improving detection signatures.