xai-official[.]sale

This domain, xai-official.sale, is flagged as an active brand impersonation threat targeting the 'across' platform. Analysis indicates the site mimics official pre-sale pages, luring victims with promises of up to 200% bonuses—a common tactic in fraudulent token or cryptocurrency schemes. The page title, 'Official Site Pre-Sale (with up to 200% Bonus),' reinforces the deceptive branding, attempting to exploit user trust in legitimate promotions. No direct evidence of a crypto drainer kit was observed, but the structure aligns with phishing infrastructure designed to harvest credentials or wallet connections.

Technical indicators confirm elevated risk. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious registrations. It resolves to IP address 104.21.80.35, a Cloudflare-hosted endpoint that obscures backend infrastructure. VirusTotal detections stand at 3/95 security vendors, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist (PhishDestroy) and lacks Google Safe Browsing (GSB) coverage, suggesting limited visibility in consumer protection systems. SSL certification via Google Trust Services provides a false veneer of legitimacy, a tactic commonly exploited in phishing operations.

Current status remains active, with no takedown or sinkholing observed. Response actions should include immediate blacklisting in enterprise security tools, DNS filtering at the resolver level, and monitoring for related domains using the same registrar or IP range. The remaining risk is elevated due to the domain's plausible branding, low detection rates among vendors, and reliance on content delivery networks (CDNs) to evade scrutiny. Users are advised to verify pre-sale promotions exclusively through official channels and avoid interacting with domains offering unrealistic bonuses or unsolicited investment opportunities.