xtoken-investing[.]com

The domain xtoken-investing.com was observed to be taken offline as of the report date (July 24, 2026). Registration records show the domain was created on March 03, 2026 through NiceNIC International Group Co., Limited, indicating a very short operational window before takedown. DNS resolution points to the IP address 188.114.96.3, which is owned by AS13335 Cloudflare, Inc. and geolocated to the United States. The domain is configured to use the Cloudflare nameservers cecelia.ns.cloudflare.com and sean.ns.cloudflare.com, and it does not present an SSL/TLS certificate, meaning any HTTP connections are unencrypted.

The only visible page title extracted from the site is "X Token Wallet," which aligns with the classified scam type of a crypto scam; no further page content has been captured, so the precise credential‑stealing or monetary‑extraction mechanisms remain unknown. Threat intelligence indicates the domain appears on a single security blocklist and has been blocked by the PhishDestroy service. VirusTotal analysis returned two positive detections out of ninety‑four antivirus engines, confirming that at least two vendors have flagged the host as malicious. No additional Safe Browsing, OTX, or other reputation entries were provided.

Because the site is already offline, the immediate risk of active exploitation is low, but the observable indicators—recent registration, lack of TLS, blocklist inclusion, and positive VirusTotal detections—justify treating the domain as hostile. Defenders should add the domain and its resolving IP (188.114.96.3) to network deny lists, monitor DNS logs for any residual queries, and ensure endpoint protection solutions are updated with the latest signatures that reference this host. Continued surveillance is recommended in case the operators resurrect the service under a new host or sub‑domain, as the underlying phishing infrastructure may be reused.