xa79p[.]com

This domain, xa79p.com, is flagged as a generic phishing site targeting cryptocurrency users through fraudulent pre-sale offers. Analysis of the page title, 'XA79P Official Website Pre-Sale (up to 200% bonus),' indicates an attempt to impersonate a legitimate token sale or investment opportunity. The site likely employs a cryptocurrency drainer kit designed to harvest wallet credentials and siphon funds upon connection, a common tactic in crypto-related phishing campaigns. No legitimate brand association is identified, and the offer structure aligns with known scam patterns in the blockchain space. Technical indicators confirm the malicious nature of this domain. VirusTotal detection shows 4 out of 95 security vendors flagging xa79p.com as malicious. The domain was registered on February 23, 2026, through NiceNIC International Group Co., Limited, a registrar frequently used for short-lived phishing domains. It resolves to the IP address 188.114.96.3, which has been linked to other fraudulent activities. Gridinsoft assigns a trust score of 3 out of 100, and the domain appears on one security blocklist. Google Safe Browsing (GSB) status is not explicitly detailed, but the presence on PhishDestroy’s blocklist further corroborates its classification as a phishing threat. As of the latest assessment, xa79p.com is offline, reducing immediate risk to end users. However, the domain remains registered and could be reactivated or repurposed for future malicious campaigns. Network defenders should maintain blocklist entries for this domain and its associated IP address. Users who interacted with the site are advised to revoke any connected wallet permissions, monitor for unauthorized transactions, and report the incident to relevant cybersecurity authorities. The elevated risk level persists due to the domain’s registration longevity and potential for reuse in similar phishing operations.