pools-onyx[.]com

This domain, pools-onyx.com, is flagged as a high-risk credential harvesting phishing infrastructure. Analysis indicates it is actively targeting users through deceptive web pages designed to capture login credentials, authentication tokens, or sensitive financial information. The site presents a generic 'Default page' title, suggesting either placeholder content or an attempt to evade detection by security tools scanning for known phishing templates.

Infrastructure analysis reveals the domain was registered on May 31, 2026, through HOSTINGER operations, UAB, a registrar frequently associated with newly established phishing sites. It resolves to IP address 88.223.85.104, hosted on AS47583 (Hostinger International Limited) in the United States. The domain is currently listed on three security blocklists and is flagged by 1 out of 95 security vendors on VirusTotal, indicating low but growing detection coverage. The SSL certificate is issued by Let's Encrypt (YR1), a common choice for threat actors due to its free and automated issuance process. Despite minimal vendor detections, the domain's recent creation date, generic page structure, and presence on multiple blocklists signal active malicious intent.

Mitigation against credential harvesting phishing requires multi-layered defenses. Network-level protections should include blocking the domain (pools-onyx.com) and its resolving IP (88.223.85.104) at firewalls and DNS filters. Endpoint security tools should be configured to detect and prevent access to newly registered domains, particularly those using Let's Encrypt certificates with short validity periods. User awareness training should emphasize the risks of 'Default page' or blank landing pages, which may precede redirection to credential capture forms. Organizations should enforce multi-factor authentication (MFA) to reduce the impact of stolen credentials, and monitor for unusual authentication attempts originating from the identified infrastructure.