xaifox[.]com

On 24 July 2026, investigators recorded the appearance of xaifox.com, a domain created on 27 February 2026 and currently listed as offline. The site was hosted behind Cloudflare’s network (ASN 13335) with the authoritative nameservers eric.ns.cloudflare.com and vita.ns.cloudflare.com resolving to the IP address 188.114.96.3, which is geolocated to the United States. No TLS certificate was presented, indicating that HTTPS was not configured at the time of capture.

The page title returned by the web server read “XAIFOX Official Website Presale Get Up to 200% Bonus!”, a phrasing consistent with a brand‑impersonation campaign that seeks to lure victims with an exaggerated investment incentive. The domain is registered through NiceNIC International Group Co., Limited, and it has been placed on a single public blocklist, where it is actively blocked by PhishDestroy. VirusTotal analysis shows that two of ninety‑three scanned security vendors flagged the domain, providing additional corroboration of malicious intent.

Because the site is presently taken offline, direct content analysis is limited; however, the combination of recent registration, Cloudflare hosting, lack of encryption, and the presence on a phishing‑specific blocklist strongly suggests a short‑lived malicious infrastructure. Defenders should continue to monitor the IP address 188.114.96.3 for any re‑use, enforce DNS‑level blocking of xaifox.com across enterprise filters, and ensure that any corporate email or web traffic that references the “200% bonus” language is scrutinized. Threat intelligence feeds should be updated to reflect the domain’s status and its association with brand‑impersonation tactics, and any future re‑activation of the domain should trigger immediate investigation.