xa59p[.]org

This investigation documents the infrastructure and threat indicators associated with xa59p.org, which is currently classified as a high‑risk brand‑impersonation campaign targeting the Ethereum brand. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare’s network (ASN 13335). DNS resolution points to the IP address 188.114.96.3, a Cloudflare‑owned node located in the United States. The site serves HTTP status 200 responses and presents the title “XA59P Official Website Pre‑Sale (up to 200% bonus)”, a phrasing commonly used to lure cryptocurrency investors. The TLS certificate is issued by Google Trust Services under the WE1 certificate profile, confirming a valid HTTPS endpoint.

Automated analysis by VirusTotal recorded 9 of 93 scanners flagging the domain, and the Gridinsoft trust score is 0 / 100, indicating a high likelihood of malicious activity. The domain appears on a single security blocklist and is specifically listed by PhishDestroy as a confirmed threat. Detected technologies include Cloudflare’s edge services and HTTP/3 support, consistent with the hosting provider’s offering. Evidence confirms that the domain actively impersonates Ethereum, yet no public page content has been captured, leaving the exact visual spoofing techniques unknown.

The presence of a legitimate‑looking SSL certificate and a responsive HTTP 200 status may reduce suspicion for uninformed users, but the combination of low trust scores, multiple vendor detections, and blocklist listings provides a strong indicator of abuse. Defenders should block DNS resolution for xa59p.org at the network perimeter, add the IP 188.114.96.3 to deny‑list rules, and monitor Cloudflare‑origin traffic for similar patterns. Continuous re‑scanning with multi‑engine services is advised to capture any evolution of the payload or additional indicators.