nubilapool[.]xyz

Analysis indicates that nubilapool.xyz was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently hosted behind Cloudflare’s network (AS13335, United States). DNS resolution points to the edge address 188.114.96.3, which is served by Cloudflare and presents the Google Trust Services / WE1 SSL certificate. The site leverages Cloudflare Browser Insights and HTTP/3, and the publicly visible page title is the generic “Just a moment…”, consistent with Cloudflare’s interstitial challenge page. VirusTotal reports five detections out of ninety‑five scanners, and the domain appears on a single security blocklist.

PhishDestroy has also listed the domain as offline and malicious. The intelligence tags the activity as an investment‑scam phishing campaign, although no further payload or lure details have been captured because the site is taken offline. Confirmed evidence includes the registration date, registrar, nameserver set (jean.ns.cloudflare.com, sam.ns.cloudflare.com), IP ownership, SSL issuer, and the detection counts from VirusTotal and PhishDestroy.

Uncertainties remain regarding the exact phishing content, target audience, and whether additional infrastructure (command‑and‑control servers, drop sites, or compromised hosts) is associated with the domain, as no sandbox or content analysis is available. Defenders should treat the domain as hostile: block nubilapool.xyz at the DNS or proxy level, add the IP address 188.114.96.3 to outbound filtering rules only when contextualized with the domain, and monitor for any future re‑registration or similar Cloudflare‑protected domains exhibiting the same registration pattern. Continuous threat‑intel feeds should be consulted for updates, and endpoint security solutions should be configured to alert on the five VirusTotal detections associated with the domain.