xa40p[.]org

Analysis of xa40p.org indicates a high‑risk fake‑airdrop operation that is actively hosted. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is currently resolved to the Cloudflare‑owned address 188.114.97.3, which is advertised as being in the United States under AS13335. Cloudflare services are confirmed by the presence of Cloudflare Browser Insights and HTTP/3 support, and the site presents a valid TLS certificate issued by Google Trust Services (WE1). The page title returned by the web server is “XA40P Presale 2025 | Official Website | Early Access …”, matching the advertised fake‑airdrop narrative. Infrastructure metrics show a Gridinsoft trust score of 0 / 100, inclusion on a single security blocklist, and active blocking by PhishDestroy. VirusTotal scans report 7 of 93 vendors flagging the domain, reinforcing the malicious assessment. The site responds with HTTP 200 and is served by the nameservers mallory.ns.cloudflare.com and rohin.ns.cloudflare.com. No additional content has been captured, so the precise tactics used on the landing page remain unknown. Defenders should treat xa40p.org as malicious, enforce DNS‑level blocking, add the domain to email and web filters, and monitor for any related C2 infrastructure that may share the same Cloudflare IP range or certificate fingerprint.