xa80b-cointelegraph[.]com

Analysis of xa80b-cointelegraph.com indicates an active crypto scam domain impersonating Ethereum-related content, leveraging the Cointelegraph brand in its page title. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to IP 104.21.87.118, hosted on Cloudflare's network (AS13335). Infrastructure analysis reveals Cloudflare nameservers (mallory.ns.cloudflare.com, rohin.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The site returns an HTTP 200 status, suggesting operational hosting. Detected technologies include WordPress, MySQL, PHP, Node.js, Vue.js, Nuxt.js, Twitter Ads, and Microsoft Clarity, which may be used to enhance credibility or track victims.

Security vendor assessments are limited but concerning: Gridinsoft assigns a trust score of 0/100, and the domain appears on at least one security blocklist (PhishDestroy). Two of 95 vendors on VirusTotal flag the domain as malicious. The page title explicitly references Cointelegraph and positions itself as an AI-blockchain cryptocurrency platform under the 'XA80B' label, aligning with known crypto scam tactics. No evidence confirms the legitimacy of this project or its association with Ethereum or Cointelegraph.

Defenders should treat this domain as high-risk due to its active status, brand impersonation, and detection by security tools. Blocking the domain and its resolving IP at network and endpoint levels is recommended. Further investigation into associated wallet addresses, social media links, or additional infrastructure (e.g., redirect chains, linked domains) may uncover broader campaign activity. The domain's reliance on Cloudflare complicates takedown efforts, but reporting to the registrar and hosting provider may aid mitigation.