xa56p[.]com

The domain xa56p.com was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently active. Infrastructure analysis shows it resolves to IP 172.67.195.61, hosted on Cloudflare (AS13335) with the service location in the United States. The authoritative name servers are eva.ns.cloudflare.com and gannon.ns.cloudflare.com, indicating the use of Cloudflare DNS. The site presents an HTTP 521 status, and Cloudflare Browser Insights and HTTP/3 are observed, confirming the front‑end is served via Cloudflare's edge network. The SSL certificate is issued by Google Trust Services under the WE1 identifier, providing a valid TLS handshake. Reputation data assigns a Gridinsoft trust score of 0 out of 100 and the domain appears on one security blocklist, currently blocked by PhishDestroy. VirusTotal scans report four of ninety‑three security vendors flagging the domain, and AlienVault OTX references a single threat‑intel pulse referencing this indicator. The page title "XA56P Official Website Pre‑Sale (up to 200% bonus)" and the classified scam type as brand impersonation indicate an attempt to lure Ethereum community members with a pre‑sale offering that references the Ethereum brand. No direct evidence of credential harvesting or malicious payload delivery has been observed, and the actual page content has not been analyzed in detail. Defenders should prioritize blocking xa56p.com at network perimeters, update endpoint and email filtering rules to include this indicator, and monitor for any connections to the associated Cloudflare IP address. Continuous intelligence gathering is recommended to detect any evolution of the payload or changes in hosting infrastructure.