xa99p[.]com

PhishDestroy has identified domain xa99p.com as a brand impersonation threat targeting Ethereum, carrying an elevated risk level. This domain was designed to deceive users by mimicking the Ethereum brand, offering a "Pre-Sale (up to 200% bonus)" to lure victims into connecting their wallets or sharing sensitive information, effectively operating as a crypto drainer. The site is now offline, but its infrastructure and indicators remain critical for understanding the threat landscape.

The domain was registered on February 21, 2026, via NiceNIC International Group Co., Limited, a registrar often associated with malicious domains. It resolves to IP address 188.114.97.3, which is linked to Cloudflare infrastructure. VirusTotal analysis shows 6 out of 95 security vendors flagging this domain as malicious, and it appears on one security blocklist. Additionally, AlienVault OTX reports its presence in one threat intelligence pulse. The SSL certificate is issued by Google Trust Services, adding a layer of false legitimacy. These technical indicators collectively paint a picture of a well-prepared phishing campaign.

To protect against such crypto drainer threats, users should always verify the legitimacy of any website offering cryptocurrency bonuses or presales, especially those mimicking well-known brands like Ethereum. Never connect your wallet or enter private keys on sites you have not independently verified. Use browser extensions that detect known phishing domains and consider using hardware wallets for transactions. If you have interacted with xa99p.com, immediately revoke any token approvals and move funds to a new wallet. Regularly monitor your accounts for unauthorized activity and report any suspicious domains to cybersecurity authorities.