xensurak[.]online

Analysis of xensurak.online indicates that the domain was registered through Unstoppable Domains, Inc. on February 21, 2026 and is presently taken offline. The site resolves to the IPv4 address 45.9.148.51, which is assigned to AS49447 Nice IT Services Group Inc. in the Netherlands. The presented SSL certificate is issued to Hestia Control Panel covering the hostname 8102be99.as49447.net, suggesting the server is using a generic control panel certificate rather than a brand‑specific one. The page title captured during the brief observation reads "Claim Your Share of the Arbitrum Ecosystem | Up to $25,000 for Active Wallets," matching the scam classification of a fake airdrop targeting users of the Arbitrum ecosystem.

The domain is flagged as a brand‑impersonation attempt against the generic brand "across," though no specific brand assets are confirmed in the evidence. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on a single security blocklist. Detection services have identified the domain as malicious: PhishDestroy lists it as blocked, and VirusTotal reports that 2 of 93 scanned security vendors flagged the domain. The limited detection coverage and the offline status leave the current hosting environment uncertain, but the combination of a low trust score, a generic SSL certificate, and the presence of a high‑value airdrop lure strongly points to a financially motivated phishing operation.

Defenders should continue to block the domain at network perimeter controls, monitor DNS queries for the associated IP range, and add the domain to internal threat feeds. Given the potential for credential harvesting or wallet compromise, any residual traffic should be investigated for signs of attempted credential submission or malicious payload delivery. Continuous re‑evaluation is advised, as the offline status may change if the operators reactivate the site.