machpool[.]xyz

This domain, machpool.xyz, is identified as a credential theft phishing operation. Analysis indicates the infrastructure is designed to harvest login credentials through deceptive login portals, likely mimicking legitimate services. No specific brand impersonation or crypto drainer kit signatures were detected in available telemetry, though the domain's behavior aligns with credential-focused phishing campaigns. The page title 'Just a moment...' suggests the use of anti-bot or redirect mechanisms to evade detection or delay analysis. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 104.21.51.213 and employs Cloudflare services, including Cloudflare Browser Insights and HTTP/3, to obscure backend infrastructure. The domain appears on one security blocklist and is flagged by 5 out of 95 security vendors on VirusTotal. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. No entries were found in Google Safe Browsing at the time of analysis, though this may reflect evasion techniques rather than benign status. The domain is currently offline, likely due to takedown efforts or infrastructure rotation. However, the registrar and hosting provider remain active, posing a residual risk of redeployment. Organizations should monitor for re-registration under similar naming conventions or IP reuse. Defenders are advised to block the domain and associated IP at network perimeters, and to scrutinize logs for prior connections to 104.21.51.213. Users should be educated on recognizing credential theft tactics, particularly those leveraging Cloudflare-protected phishing pages.