myxaiwallet[.]org

On July 25, 2026, intelligence analysts observed that the domain myxaiwallet.org was taken offline and is associated with a crypto‑drainer campaign targeting users of the xAI token presale. The site presented the page title “xAI Token Official Presale,” indicating an attempt to lure investors into a fraudulent token offering. Registration data shows the domain was created on 25 February 2026 by NiceNIC International Group Co., Limited and uses Cloudflare’s DNS resolvers alina.ns.cloudflare.com and quinton.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which belongs to ASN 13335 operated by Cloudflare, Inc., and is geolocated in the United States.

No TLS certificate was observed, indicating the site served HTTP only. Detection services have flagged the domain: two of ninety‑three VirusTotal scanners raised alerts, and the domain appears on three security blocklists. It is also listed as blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the perception of malicious activity. The identified threat type is a crypto scam, specifically a crypto drainer, where victims are typically prompted to send tokens to a wallet controlled by the attacker.

Current evidence does not reveal the exact wallet address or payload, and the site’s content has not been captured since the service was taken down. Defenders should continue to monitor the IP 188.114.97.3 for any re‑use, enforce outbound transaction controls for xAI token transfers, and update URL filtering and endpoint protection rules to include myxaiwallet.org and its associated IP range. Given the Cloudflare hosting, any future re‑hosting under the same IP could inherit the blocklist reputation, so proactive network‑level blocking is advisable. Analysts should also watch for newly registered domains created after February 2026 that reference xAI or presale terminology, as the adversary appears to reuse similar naming patterns.