xa70p-fxempire[.]com

Analysis of the domain xa70p-fxempire.com indicates it was a cryptocurrency scam site leveraging the fabricated narrative of an 'Elon Musk-Backed AI-Blockchain Project' named XA70P. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolved to IP 104.21.78.16, hosted on Cloudflare's network (AS13335). As of July 25, 2026, the domain is offline, returning an HTTP 403 status, and appears on one security blocklist (PhishDestroy). Only 4 out of 93 security vendors on VirusTotal flagged the domain, suggesting limited detection at the time of scanning.

The SSL certificate was issued by Google Trust Services (WE1), a common provider for both legitimate and malicious sites. Infrastructure analysis reveals the use of Cloudflare nameservers (ashley.ns.cloudflare.com, jermaine.ns.cloudflare.com), which is typical for both legitimate services and threat actors seeking to obscure hosting details. The page title explicitly references Elon Musk and a non-existent AI-blockchain project, a tactic consistent with cryptocurrency scams designed to exploit high-profile figures for credibility. No evidence of a specific phishing kit or additional brand impersonation beyond the page title is present in the available data.

Defenders should treat this domain as malicious based on its scam classification, blocklist inclusion, and association with a fabricated investment narrative. While the domain is currently offline, historical DNS and WHOIS records should be preserved for potential incident response or threat hunting activities. The Gridinsoft trust score of 0/100 further supports the assessment of elevated risk. No additional context about the scale of the campaign or victim count is available from the provided intelligence.