xeetpresale[.]xyz

On July 24 2026 analysts observed that the domain xeetpresale.xyz is currently taken offline but retains multiple indicators of a crypto‑related impersonation campaign targeting the BNB Chain ecosystem. The domain was registered on 3 November 2025 through Ultahost, Inc. and resolves to the IPv4 address 45.12.2.67, which is allocated to AS6698 Virtual Systems LLC in Ukraine. Both authoritative name servers (ns1.xeetpresale.xyz and ns2.xeetpresale.xyz) are self‑hosted on the same domain, a pattern frequently associated with fast‑flux or disposable infrastructure. No TLS certificate is presented for the host, meaning any HTTP connection would be unencrypted and easily intercepted. Automated scanning on VirusTotal recorded three positive detections out of ninety‑five participating AV engines, indicating that at least a subset of security products recognize the domain as malicious.

The domain appears on a single public blocklist and is explicitly listed by PhishDestroy as a known phishing host. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious classification. The page title returned during the brief live check—“XEET Token Presale & Airdrop – Gamified Social Arena for Creators”—references an airdrop scheme and aligns with the “Airdrop Scam” phishing kit identified in the intelligence. The overall scam type is catalogued as a crypto scam, and the site impersonates the BNB Chain brand, suggesting an attempt to lure users into sending funds or private keys under the pretense of a token presale. Because the site is presently offline, active content retrieval was not possible, and the exact page markup, credential‑capture mechanisms, or redirect chains remain unverified.

Nevertheless, the combination of recent registration, low‑reputation hosting, lack of encryption, multiple vendor detections, and inclusion on reputable blocklists provides sufficient evidence for defensive action.