xai99r[.]org

This domain, xai99r.org, was registered on 2026-02-21 through NiceNIC International Group Co., Limited and is hosted on Cloudflare (nameservers mallory.ns.cloudflare.com, rohin.ns.cloudflare.com). DNS resolution points to IP 104.21.82.16, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents an HTTPS service using a Google Trust Services / WE1 certificate and returns HTTP status code 200, indicating the page is reachable. Page metadata reports the title “XA70B Official Pre‑Sale — Get Up to 200% Bonus!”, suggesting the site is attempting to masquerade as a pre‑sale offering for the XA70B token and promises a large bonus.

Underlying technology fingerprints include WordPress, MySQL, PHP, jQuery, Cloudflare Browser Insights, Cloudflare CDN, and HTTP/3, which are consistent with a typical compromised or fraud‑hosting stack. Reputation checks show a Gridinsoft trust score of 0 / 100, and the domain is listed on the PhishDestroy blocklist as well as one additional security blocklist. VirusTotal has flagged the domain in 7 of 93 scanned vendors, reinforcing the malicious classification. No further threat intelligence (e.g., OTX, Safe Browsing) is provided in the current dataset.

Based on the observable indicators—low trust score, multiple vendor detections, active blocklist entries, and a page title that explicitly advertises a fraudulent pre‑sale—the domain should be treated as high‑risk phishing infrastructure. Defenders should block DNS resolution for xai99r.org, deny outbound connections to 104.21.82.16, and add the domain and its IP to network‑level deny lists. Continuous monitoring for any changes in the page content or additional infrastructure expansion is advised, as the current analysis cannot confirm the full scope of the phishing campaign.