twt-pool[.]top

Analysis as of July 24, 2026 indicates that the domain twt-pool.top was registered on November 11, 2025 through NiceNIC International Group Co., Limited and is currently hosted on Cloudflare’s network (AS13335). The domain resolves to the IP address 104.21.21.92, which is geolocated to the United States and is served by Cloudflare’s edge infrastructure. DNS resolution uses the Cloudflare nameservers alexis.ns.cloudflare.com and brenda.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The site returned an HTTP 522 “Connection timed out” response, and no SSL certificate was observed, suggesting that the service is either misconfigured or intentionally offline. The domain has been taken offline and is listed as blocked by the PhishDestroy blocklist, as well as appearing on one additional security blocklist.

VirusTotal reports that eight of ninety‑five scanning engines have flagged the domain, indicating a moderate level of detection across independent products. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. Threat intelligence classifies the activity as an investment‑related scam employing an “Airdrop Scam” phishing kit. No legitimate brand is explicitly referenced in the available data, and the page title provides no further insight into the content that was hosted.

The combination of a recent registration date, Cloudflare hosting, lack of TLS, and multiple vendor detections aligns with typical infrastructure patterns used for short‑lived phishing or scam campaigns. Uncertainties remain regarding the exact content that was served before the domain was taken offline, as the only visible page title is the generic timeout message. Defenders should continue to block the domain at network perimeter devices, update URL filtering and threat‑intel feeds with the observed indicators, and monitor for any re‑registration or reuse of the underlying IP address.