codattapool[.]xyz

Analysis performed on July 22, 2026 shows that the domain codattapool.xyz, created on February 21, 2026 and registered through NiceNIC International Group Co., Limited, is linked to an investment‑scam operation. The domain resolves to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Traffic is served behind Cloudflare’s edge network, with Browser Insights and HTTP/3 enabled, and the TLS certificate is issued by Google Trust Services (WE1), indicating a valid certificate chain but offering no assurance of legitimacy. The only page element observed before takedown is the title “Even geduld…”, which does not reveal the nature of the content.

VirusTotal scans record five of ninety‑three security vendors flagging the domain as malicious, providing independent confirmation of its threat status. The domain is listed on at least one public blocklist and has been actively blocked by the PhishDestroy service, reinforcing its classification as hostile. Nameserver records point to gerald.ns.cloudflare.com and hope.ns.cloudflare.com, consistent with the observed Cloudflare front‑end. Current status is offline, so live interaction cannot be verified, and no additional artefacts such as malware hashes, phishing‑kit identifiers, or Safe Browsing alerts are available.

Defenders should continue to deny connections to 188.114.96.3 at the network perimeter, enforce DNS filtering for codattapool.xyz, and watch for re‑hosting attempts on other Cloudflare‑controlled addresses. Correlation with other investment‑scam indicators, especially those sharing the same registrar or similar registration timelines, is advised. Any future resolution of the domain should be treated as hostile and blocked accordingly.