xaiquest[.]icu

This domain, xaiquest.icu, operates as a fraudulent cryptocurrency presale platform designed to deceive users into participating in a fake token sale. The page advertises a "200% bonus" incentive, a common tactic used in crypto drainer schemes to lure victims into connecting wallets or transferring funds to attacker-controlled addresses. Analysis of the domain’s infrastructure and content indicates it is not affiliated with any legitimate project, instead functioning as a social engineering tool to exploit users seeking early investment opportunities in emerging tokens or platforms. Evidence supporting this assessment includes detection by 16 out of 95 security vendors on VirusTotal, with the domain appearing on at least one security blocklist. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.170.45, hosted on Cloudflare’s network (AS13335), which is often leveraged to obfuscate the true origin of malicious infrastructure. Notably, the domain lacks an SSL certificate, further reducing its legitimacy and increasing the risk of interception or tampering during user interactions. Users who visited xaiquest.icu or engaged with its content should take immediate action to mitigate potential compromise. If any wallet connections were made or funds were transferred, affected parties should revoke smart contract approvals, transfer remaining assets to a secure wallet, and monitor transaction histories for unauthorized activity. Additionally, devices used to access the site should be scanned for malware, and credentials for any associated accounts should be updated. Given the domain’s offline status, users should remain vigilant for similar schemes, particularly those promoting unrealistic investment returns or unsolicited presale opportunities.