relaypool[.]xyz

This domain, relaypool.xyz, is flagged as a generic phishing site specializing in credential harvesting. Analysis indicates no direct association with a specific brand or known phishing kit, though the infrastructure suggests a typical credential theft operation. The site employs evasion techniques, including Cloudflare protection and HTTP/3, to obscure its malicious intent and resist takedown efforts. Technical indicators confirm elevated risk: the domain is detected by 10 out of 95 security vendors on VirusTotal, registered through NiceNIC International Group Co., Limited, and resolves to IP address 188.114.96.3. Created on February 21, 2026, the domain remains unlisted on Google Safe Browsing but appears on at least one security blocklist. The page title 'Just a moment...' is consistent with Cloudflare interstitial pages, often abused to delay or deter automated analysis. The domain remains active and operational, with no signs of remediation or suspension. Response actions should include immediate blocking of the domain and associated IP at network and endpoint levels. Given the use of Cloudflare and HTTP/3, additional scrutiny of encrypted traffic is recommended. The remaining risk is elevated due to the domain's persistence, low detection rate, and lack of public denylisting by major providers. Organizations should monitor for credential theft attempts linked to this infrastructure and review authentication logs for anomalous access patterns.