xa90b[.]net

The domain xa90b.net has been identified as a crypto drainer phishing site with an elevated risk level. The site is currently offline and was previously used to impersonate a token pre-sale offer, promising a 200% bonus to potential victims. This domain poses a significant threat to users who may be deceived into providing sensitive information or cryptocurrency.

Infrastructure analysis reveals that xa90b.net was registered through NiceNIC International Group Co., Limited on February 21, 2026. The domain resolves to the IP address 188.114.96.3, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. VirusTotal reports that 9 out of 95 security vendors have flagged this domain as malicious. Additionally, the site appears on one security blocklist and is blocked by the PhishDestroy service. The SSL certificate for the domain is issued by Google Trust Services / WE1, which may have initially lent a false sense of security to unsuspecting users.

Currently, xa90b.net is offline, but the infrastructure and historical data suggest it was actively used for phishing activities. Security researchers recommend that users who may have interacted with this domain should monitor their financial and account activity for any unauthorized transactions. Network administrators should ensure that the domain remains blocked and update their security policies to include this threat in their training and awareness programs.