reservoirpool[.]xyz

reservoirpool.xyz was added to the phishing domain database on 2026-07-12. The domain is classified as a staking scam under the generic_phishing category and is currently marked as active and under investigation. The registration date of 2026-03-27 and the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED indicate a recent creation window typical of fast‑flux phishing campaigns.

Technical reconnaissance shows the domain resolves to the IPv4 address 172.67.141.110, which is hosted by Cloudflare, Inc. in California. The authoritative name servers are adrian.ns.cloudflare.com and archer.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. An HTTPS connection presents a certificate issued by Google Trust Services under the WE1 trust anchor, and HTTP requests return a 403 status, suggesting the front‑end is deliberately restricted to impede casual browsing while retaining malicious payload delivery through other vectors.

Open Threat Exchange (OTX) lists one pulse that references this domain, and it appears on a single security blocklist. PhishDestroy has already enacted a block, indicating that some downstream filtering networks have taken action. The Gridinsoft trust score of 0 out of 100 reinforces the low reputation, yet VirusTotal currently reports 0 detections out of 95 engines, showing that the payload, if any, has not yet been captured by public scanners.

Analysts should treat reservoirpool.xyz as a high‑confidence malicious indicator despite the lack of detections on public sandboxes. Immediate mitigation steps include adding the domain and its resolved IP address to block lists, monitoring TLS traffic for the associated Google Trust Services certificate, and flagging any email or web content that references staking or investment promises linked to the domain. Continuous observation is recommended to detect any shift in hosting or the emergence of active payloads.