arcanapool[.]xyz

The domain arcanapool.xyz was registered on March 27, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently resolved to the IP address 188.114.96.3. The IP is hosted by CloudFlare in Canada and the web server returns an HTTP 403 status code while presenting a page titled “Just a moment…”. The site uses an SSL certificate issued by Google Trust Services (WE1), indicating a valid TLS handshake despite the suspicious front‑end behavior.

Infrastructure analysis shows the domain is served over CloudFlare’s network, employing the authoritative nameservers mary.ns.cloudflare.com and rommy.ns.cloudflare.com. The low Gridinsoft trust score of 0 / 100 and the fact that the page is blocked by PhishDestroy suggest the site is being used for malicious purposes. AlienVault OTX has linked arcanapool.xyz to a single threat‑intelligence pulse, and the domain appears on one external security blocklist, reinforcing the notion of an emerging threat.

The observed activity aligns with a staking scam classification, wherein victims are likely enticed to deposit cryptocurrency under the pretense of earning staking rewards. Although VirusTotal currently reports zero detections out of ninety‑five scans, the absence of detections does not imply safety; the zero detection count combined with the poor trust score and blocklist presence points to a deliberately evasive campaign that has not yet been widely cataloged.

Defenders should immediately add arcanapool.xyz to network and endpoint blocklists, enforce DNS sinkholing for the domain, and monitor outbound connections to the associated IP address. Continuous re‑evaluation of threat‑intel feeds is advised, as additional detections may surface on broader platforms. Organizations handling cryptocurrency should educate users about the specific staking scam narrative and encourage verification of any unsolicited investment offers.