repools[.]xyz

This domain, repools.xyz, was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently hosted on Cloudflare infrastructure (nameservers nena.ns.cloudflare.com, piers.ns.cloudflare.com). DNS resolution points to IP address 104.21.91.166, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 root, confirming the use of valid HTTPS. Cloudflare services are observable through HTTP/3 support and Browser Insights, and the only visible page title is “Just a moment…”, typical of Cloudflare’s interstitial page.

VirusTotal analysis shows that five of ninety‑five scanning engines flagged the domain, indicating a modest level of malicious confidence. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, reinforcing the assessment that it is being used for malicious purposes. The threat classification supplied is an investment scam, although the specific target brand or financial service is not disclosed in the available data. Defenders should treat repools.xyz as a high‑confidence malicious indicator.

Immediate actions include adding the domain to DNS‑based block lists, updating web proxy and firewall rules to deny traffic to the associated IP range, and monitoring outbound connections for any attempts to reach Cloudflare‑served endpoints that match the certificate fingerprint. Because the site is currently offline, continuous re‑scanning is advised to detect any re‑activation. Sharing the indicator with threat‑intel platforms will aid broader community awareness. Until further content analysis is performed, the exact phishing kit or credential‑harvesting method remains unknown, but the infrastructure footprint and vendor detections suggest a purposeful campaign aimed at defrauding investors.