xa81p-fxempire[.]com

Analysis of the domain xa81p-fxempire.com indicates it is an active crypto scam impersonating a high-profile initial coin offering (ICO) linked to Elon Musk and blockchain technology. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335). The page title explicitly promotes 'XA81P ICO: Elon Musk’s AI-Blockchain Vision Captures Global Investor Imagination,' a clear attempt to exploit Musk’s public persona to lend credibility to a fraudulent investment scheme. Security vendors have begun flagging this domain, with 6 out of 93 engines on VirusTotal detecting malicious activity.

It appears on at least one security blocklist and is actively blocked by PhishDestroy. The domain’s Gridinsoft trust score is 0/100, reinforcing its classification as high-risk. Infrastructure analysis reveals the use of Cloudflare nameservers (eric.ns.cloudflare.com and vita.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1), which, while providing encryption, does not validate the legitimacy of the site’s content. The HTTP status code 521 suggests the web server is either misconfigured or intentionally restricting access, a common tactic in scam operations to evade automated crawlers.

The scam type is explicitly identified as a crypto scam, with no evidence of additional phishing vectors such as credential harvesting or malware distribution. Defenders should treat this domain as a confirmed threat and prioritize blocking it at the DNS and network levels. Organizations should also monitor for related domains registered through the same registrar or resolving to the same IP range, as scammers frequently rotate infrastructure. Given the domain’s recent registration and active status, further monitoring is advised to track its evolution or potential takedown efforts.