xa37x[.]com

This domain, xa37x.com, is actively engaged in brand impersonation targeting Ethereum, as indicated by its page title and confirmed threat intelligence. Registered on August 6, 2025, through NiceNIC International Group Co., Limited, the domain remains operational with a high-risk classification. Analysis of its infrastructure reveals Cloudflare-hosted nameservers (derek.ns.cloudflare.com and nelci.ns.cloudflare.com) and resolution to the IP address 104.21.94.219, associated with AS13335 Cloudflare, Inc. in the United States. The site returns an HTTP 200 status, suggesting an active and accessible web presence. The page title, 'XA37X Official Website Pre-Sale (up to 200% bonus),' explicitly references a pre-sale offer, which aligns with social media phishing tactics designed to lure victims into fraudulent investment schemes. While the domain is flagged by one security vendor on VirusTotal and appears on a single blocklist (PhishDestroy), its Gridinsoft trust score of 0/100 further corroborates its malicious classification. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as legitimate certificates are frequently abused in phishing operations. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency-related activity is monitored. The use of Cloudflare infrastructure complicates IP-based blocking, necessitating reliance on domain reputation and behavioral detection mechanisms. Given the domain's recent creation and active status, continuous monitoring for related infrastructure (e.g., newly registered domains with similar naming patterns) is recommended. The exact content of the site has not been analyzed, but the presence of a pre-sale offer in the page title suggests a focus on financial fraud.