xa909k[.]org

This domain, xa909k.org, is flagged as a crypto drainer scam targeting cryptocurrency investors through a fraudulent token presale offering. The page title, 'XA909K Official Presale (Up to 200% Bonus)', is designed to lure victims with unrealistic financial incentives, a common tactic in cryptocurrency-related fraud. Analysis indicates no direct brand impersonation, but the scheme mimics legitimate presale events to deceive users into connecting wallets or transferring funds to attacker-controlled addresses. The absence of a known drainer kit signature suggests a custom or obfuscated payload, increasing the difficulty of detection by automated tools.

Technical indicators confirm elevated risk: the domain resolves to IP 188.114.96.3 (AS13335, Cloudflare, Inc.), was registered on September 13, 2025, via NiceNIC International Group Co., Limited, and is currently offline. VirusTotal reports 15 out of 95 security vendors flagging the domain, while it appears on one security blocklist (PhishDestroy). The SSL certificate, issued by Google Trust Services (WE1), provides no inherent trust, as fraudulent domains frequently abuse legitimate certificate authorities. No Google Safe Browsing (GSB) hits were recorded at the time of analysis, though this may reflect a lag in GSB updates rather than a clean status.

As of the latest assessment, xa909k.org has been taken offline, likely due to enforcement actions or infrastructure takedowns. However, the domain remains registered, and the threat actor may re-deploy the scam under a new hostname or IP. Residual risk includes potential wallet addresses or smart contracts associated with the campaign, which could still be active. Users who interacted with the domain are advised to revoke any connected wallet permissions, monitor transaction histories for unauthorized activity, and report associated addresses to blockchain analytics platforms. Organizations should update blocklists to include the domain, IP, and SSL certificate thumbprint to prevent future access attempts.