xa80b-fxempire[.]com

The domain xa80b-fxempire.com is currently classified as a high‑risk generic phishing site that delivers a crypto‑scam payload. VirusTotal records show that five of ninety‑three security vendors flagged the domain, indicating that at least a subset of scanners identified malicious components. The site appears on a single public security blocklist and is specifically blocked by the PhishDestroy service, reinforcing the assessment of malicious intent. The public page title observed is “Inside XA80B: The Elon Musk‑Backed AI‑Blockchain Project Everyone’s Talking About | FXEmpire”, which suggests a lure targeting interest in AI and blockchain technologies. Technical analysis reveals the use of Google Tag Manager, Cloudflare Browser Insights, Cloudflare services, and HTTP/3, all typical of legitimate hosting but also commonly leveraged by threat actors to mask activity behind reputable infrastructure.

The domain resolves to the IP address 188.114.96.3, owned by AS13335 Cloudflare, Inc., and the hosting location is listed as the United States. Nameservers are mallory.ns.cloudflare.com and rohin.ns.cloudflare.com, confirming Cloudflare DNS management. The SSL certificate is issued by Google Trust Services under the WE1 certificate profile, providing a valid HTTPS connection that may increase user trust. Registration data shows the domain was created on 21 February 2026 through NiceNIC International Group Co., Limited, indicating a relatively new registration. Gridinsoft assigned a trust score of 0 out of 100, which is the lowest possible rating and typically reflects a high confidence of malicious behavior.

HTTP responses return a 200 status code, meaning the server delivers content without error, which is consistent with an active phishing page. While the page title and technical footprints are documented, the full content of the landing page has not been publicly disclosed, leaving the exact phishing vector and credential‑capture mechanisms unverified.