balmypools[.]xyz

This domain, balmypools.xyz, was registered on 27 March 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The authoritative nameservers are grace.ns.cloudflare.com and jose.ns.cloudflare.com, indicating that the domain is fronted by Cloudflare’s network. DNS resolution points to IP address 104.21.43.210, which is owned by Cloudflare, Inc. and geolocated to Canada. The site presents an HTTP 403 response and the only observed page title is “Just a moment…”, suggesting that the content is being protected by Cloudflare’s challenge page rather than a visible phishing landing page. VirusTotal records show that 1 of 94 security vendors has flagged the domain, and the domain appears on a single blocklist maintained by PhishDestroy. AlienVault OTX includes the domain in one threat‑intelligence pulse. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, confirming a valid TLS handshake. The Gridinsoft trust score is 0/100, and the overall risk rating is high with the campaign classified as an investment scam. Analysis indicates that the infrastructure is typical of a newly created fraud operation that relies on Cloudflare’s protection to hide the backend. No additional indicators such as malicious payloads, credential‑stealing forms, or specific victim targeting have been disclosed, leaving the exact content of the site uncertain. Defenders should block any outbound connections to 104.21.43.210, add balmypools.xyz to URL filtering policies, and monitor for related DNS queries. Continuous re‑scanning is recommended to capture any future changes in the site’s behavior or additional detections from security vendors.