xa29x[.]com

The domain xa29x.com was created on August 04, 2025 and is currently taken offline. Infrastructure analysis shows the domain resolves to IP address 104.21.16.1, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The registrar listed for the domain is NICENIC INTERNATIONAL GROUP CO., LIMITED, indicating a registration pathway commonly leveraged by malicious operators. The site presented the page title "XA29X Official Website Pre‑Sale (up to 200% bonus)" and is classified as a crypto scam that impersonates the Ethereum brand, suggesting an attempt to lure cryptocurrency investors with a pre‑sale promotion.

Detection data indicates the domain is blocked by PhishDestroy and appears on a single security blocklist. The Gridinsoft trust score is 0 out of 100, reflecting a lack of confidence in the host. On VirusTotal, two of ninety‑three security vendors flagged the domain, providing independent confirmation of malicious intent. The SSL certificate is identified as type WE1, but no further validation details are available.

Given the observed evidence, the primary risk vector is brand impersonation aimed at cryptocurrency users, with the potential for financial loss through fraudulent pre‑sale offers. Defenders should ensure the domain is added to network‑level deny lists, update DNS filtering policies to block resolution of xa29x.com, and monitor for any re‑registration attempts that could resurrect the malicious site. Continuous telemetry from threat intelligence feeds should be consulted for any emerging indicators that reference the same IP address, registrar, or SSL characteristics. While the site is presently offline, the infrastructure components remain active and could be repurposed for future campaigns, so proactive containment is advised.