xaicor[.]net

This domain is flagged as an elevated-risk crypto presale scam designed to deceive users into transferring cryptocurrency under false pretenses. Analysis indicates the site impersonates the XAICOR brand, luring victims with fabricated investment bonuses of up to 200%. The threat type is classified as a cryptocurrency drainer, where attackers exploit social engineering to empty wallets once funds are deposited. Infrastructure analysis reveals the domain xaicor.net was registered on February 21, 2026, through NiceNIC International Group Co., Limited, an uncommon registrar for legitimate crypto projects. It resolves to IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic for malicious sites. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of security. VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by PhishDestroy. The creation date discrepancy (2026) further suggests fraudulent intent, as domains are typically registered years in advance for legitimate presales. Mitigation requires immediate blocking of the domain and its resolving IP across all network security controls. Users who interacted with the site should revoke any wallet permissions granted and transfer remaining funds to a new, secure wallet. Organizations should monitor for transactions linked to the domain or IP and alert affected users. Cryptocurrency exchanges and wallet providers should flag addresses associated with this campaign to prevent further fund drainage. Security teams are advised to update detection rules to include the domain, IP, and SSL certificate fingerprint as indicators of compromise.