xa20r[.]net

This domain, xa20r.net, is currently under investigation for hosting an active investment scam targeting cryptocurrency users. Analysis indicates the site presents itself as a token pre-sale platform, as evidenced by the page title 'Secure Your XA20R Tokens Now: Pre-Sale with 200% Bonus Offer!' The domain was registered on May 8, 2026, through Internet Domain Service BS Corp, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the site is proxied behind Cloudflare, resolving to the IP address 188.114.96.3, which is geolocated in Canada. The use of Cloudflare nameservers (mallory.ns.cloudflare.com and rohin.ns.cloudflare.com) is consistent with threat actors attempting to obscure the origin of malicious traffic. The domain appears on one security blocklist and has been flagged in a single AlienVault OTX threat intelligence pulse, suggesting early detection by automated systems. A Gridinsoft trust score of 0 out of 100 further supports the classification of this domain as malicious. The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as legitimate certificates are commonly exploited to lend false credibility to fraudulent sites. While VirusTotal currently shows 0 out of 95 detections, this absence of flags does not confirm safety, as newer or low-volume scams often evade initial detection. The exact nature of the scam remains unverified due to limited page content analysis, but the page title and scam type classification indicate a likely fraudulent investment scheme. Defenders should treat this domain as high-risk and consider blocking it at the DNS or network level. Monitoring for additional threat intelligence reports is recommended, as further evidence may emerge regarding the scope of the operation or associated infrastructure. Given the domain's recent registration and active status, users should be cautioned against engaging with any offers or transactions promoted on this site.