xa98b-cointelegraph[.]com

This domain is flagged as an elevated-risk brand impersonation threat targeting Ethereum users through deceptive AI-blockchain cryptocurrency schemes. Analysis indicates the site masquerades as a legitimate news platform to harvest wallet credentials, private keys, or personal information under false pretenses of exclusive token offers or investment opportunities. Infrastructure analysis reveals the domain xa98b-cointelegraph.com was registered on February 21, 2026, via NiceNIC International Group Co., Limited. It resolves to IP address 104.21.7.130 and is currently offline. Security vendors on VirusTotal flagged the domain at a 3/95 detection rate, while it appears on one security blocklist. The site employed Google Trust Services for SSL certification and ran on WordPress with MySQL, PHP, Node.js, Vue.js, and Nuxt.js. Additional technologies detected include Twitter Ads for promotion and Microsoft Clarity for user behavior tracking. Gridinsoft assigned a trust score of 0/100, reinforcing its malicious classification. Mitigation requires immediate action from security teams and end users. Network administrators should block the domain and its resolving IP (104.21.7.130) at the firewall or DNS level. Users who interacted with the site must revoke any wallet permissions granted, rotate private keys, and monitor accounts for unauthorized transactions. Organizations should update phishing awareness training to include brand impersonation tactics involving fake crypto news sites, particularly those leveraging AI or blockchain narratives. Security teams are advised to scan for indicators of compromise, including the domain, IP, and associated SSL certificate thumbprint, across logs and endpoints.