xai320k[.]com

The domain xai320k.com was identified as an active brand‑impersonation site targeting Ethereum users. The page title “xAI320K Official Website Pre‑Sale (up to 200% bonus)” indicates a fraudulent pre‑sale offering that leverages the Ethereum brand to lure victims. PhishDestroy has already added the domain to its blocklist, confirming its malicious intent.

Infrastructure analysis shows the domain is hosted behind Cloudflare (AS13335) with the resolved address 172.67.156.29, a location attributed to the United States. The authoritative nameservers are delilah.ns.cloudflare.com and dom.ns.cloudflare.com, both belonging to the Cloudflare network. Registration was performed through NiceNIC International Group Co., Limited on 5 January 2025, and the domain lacks an SSL certificate while responding with HTTP 200 to requests.

Reputation services provide additional corroboration: Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that 5 of 95 scanned security vendors flag the domain as malicious. The domain appears on a single security blocklist, reinforcing the observed malicious behavior. No evidence of additional hosting infrastructure, command‑and‑control servers, or payload delivery mechanisms is currently available, leaving the exact attack vector and victim interaction path unverified.

Given the confirmed brand impersonation, the presence of a high‑risk rating, and the active hosting environment, defenders should block DNS resolution for xai320k.com at network perimeters and update endpoint protection signatures to include the domain. Monitoring of outbound traffic to the IP address 172.67.156.29 for anomalous connections is advised, as is the collection of any HTTP request logs that reference the page title. Incident response teams should treat any user reports involving unsolicited Ethereum pre‑sale offers as potential compromises and initiate standard containment procedures.