xautget[.]today

On 24 July 2026, the domain xautget.today was observed as an inactive resource linked to a brand‑impersonation campaign targeting Binance. The site’s sole page title, “Tether Gold – The World’s Leading Gold Token,” indicates a focus on a cryptocurrency token, aligning with the classified scam type of a crypto scam. The domain was registered on 21 February 2026 and resolves to the IPv6 address 2a06:98c1:3120::3, which is hosted within the United States under AS13335, known to be owned by Cloudflare, Inc. The hosting arrangement suggests the use of a reputable content‑delivery network, a common tactic for evading simple geolocation blocks. Reputation data show that the domain appears on two security blocklists and has been actively blocked by the PhishDestroy and ScamSniffer detection platforms.

VirusTotal analysis recorded a single positive detection out of ninety‑five scanned security vendors, reinforcing the presence of malicious intent despite a low detection count. The SSL certificate presented with the label “WE1,” but no further certificate details are available. Given the offline status at the time of analysis, active probing is not possible, yet the recorded indicators provide sufficient evidence for defensive measures. Network defenders should add the IPv6 address 2a06:98c1:3120::3 to block lists and enforce filtering of any HTTP or HTTPS traffic directed to xautget.today.

Email gateways should flag any messages containing this domain as suspicious, especially those purporting to originate from Binance or referencing Tether Gold. Continuous monitoring of the domain’s registration and DNS records is recommended, as re‑activation under a different IP or certificate is plausible. The elevated risk rating reflects the combination of brand impersonation, cryptocurrency focus, and partial detection by reputable security services.