xa500k[.]com

On 23 July 2026, xa500k.com was observed as an offline site that had previously advertised a presale offering up to a 200 % bonus, as indicated by the page title “XA500K Official Website Presale (up to 200% bonus)”. The domain was registered on 2 January 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) with the resolved address 172.67.215.118 located in the United States. DNS resolution uses the Cloudflare authoritative nameservers ashley.ns.cloudflare.com and jermaine.ns.cloudflare.com. HTTPS service is provided by a Google Trust Services certificate (WE1), and an HTTP request to the root returns a 403 status code, suggesting that public access is restricted or the site has been taken down.

VirusTotal analysis shows that 13 of 93 scanning engines flagged the domain, indicating a moderate level of detection across security products. The domain appears on a single public blocklist and has been explicitly added to the PhishDestroy blocklist, reinforcing its classification as a phishing resource. The observed phishing kit is identified as “Token Presale”, which is commonly used to lure victims into providing cryptocurrency‑related credentials under the pretense of a token offering. Given the available telemetry, the infrastructure components—Cloudflare IP, Google‑issued TLS certificate, and the NiceNIC registrar—are consistent with typical abuse infrastructure rather than legitimate business services.

However, no content beyond the page title has been captured, and the exact payload or credential‑harvesting mechanisms remain unknown. Defenders should therefore block the domain and its associated IP address at the network perimeter, add the observed nameservers to threat‑intel feeds, and monitor for any resurgence of the domain or related sub‑domains. Continuous re‑scanning with multi‑engine services is advised to capture any future changes in detection status.