xa50b[.]com

xa50b.com was registered on 23 February 2026 through NiceNIC International Group Co., Limited. The domain resolves to the IP address 188.114.96.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The authoritative nameservers are bailey.ns.cloudflare.com and lennox.ns.cloudflare.com, indicating that the site is hosted behind Cloudflare’s reverse‑proxy service. No SSL/TLS certificate was observed, meaning that HTTP connections would be unencrypted if the site were reachable. The page title returned by the server before the site was taken offline reads “XA50B Presale 2025 | Official Website | Early Access …”, suggesting that the domain is being used to masquerade as an official presale portal for a product or token named XA50B.

Threat‑intelligence feeds show that the domain is currently listed on at least one security blocklist and has been actively blocked by the PhishDestroy sinkhole. Gridinsoft’s proprietary trust rating assigns the domain a score of 0 out of 100, reflecting an extremely low confidence in legitimacy. On VirusTotal, seven out of ninety‑three antivirus and URL‑reputation engines flagged the domain, providing additional corroboration of malicious intent. No Safe Browsing, Open Threat Exchange, or other community‑based indicators were supplied in the available data set.

The combination of a recent registration date, lack of TLS, use of a shared Cloudflare IP, a deceptive page title, low trust score, and multiple vendor detections points to a typical phishing infrastructure that aims to lure victims into a presale or early‑access scheme. Because the site is presently offline, active exploitation cannot be confirmed, but the observed indicators merit pre‑emptive defensive actions. Organizations should add 188.114.96.3 to their outbound allow/deny lists, block both Cloudflare nameservers associated with the domain, and ingest the domain into internal URL filtering and email security solutions.