xa32p[.]net

This domain, xa32p.net, operates as a fraudulent cryptocurrency presale platform designed to deceive users into transferring funds under the false promise of a 200% bonus. The site impersonates a legitimate token launch, leveraging social engineering tactics to exploit victims seeking early investment opportunities. Analysis of the page title, 'XA32P Official Pre-Sale — Get Up to 200% Bonus!', confirms the domain’s intent to mimic a high-reward investment scheme, a common tactic in crypto-related phishing campaigns to lure targets with unrealistic returns. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious registrations. VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The domain resolves to the IP address 104.21.12.19, hosted on Cloudflare’s network (AS13335), which is often abused by threat actors to obscure infrastructure. The SSL certificate, issued by Google Trust Services (WE1), provides no inherent trust, as attackers routinely exploit free or automated certificate issuance to lend false legitimacy to phishing sites. Users who visited xa32p.net or interacted with its content should take immediate action. Any credentials, wallet addresses, or transaction details entered on the site must be considered compromised. Victims should revoke access to connected cryptocurrency wallets, monitor accounts for unauthorized transactions, and report the incident to relevant financial or blockchain security platforms. If funds were transferred, contact the receiving exchange or wallet provider to attempt recovery, though success rates are typically low. Additionally, scan local devices for malware, as phishing sites may deploy secondary payloads to maintain persistence or harvest further data.