xaionchain[.]com

On July 24, 2026, the domain xaionchain.com was evaluated as an elevated‑risk brand‑impersonation site. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare edge address 104.21.48.49, which is announced by AS13335 (Cloudflare, Inc.) and geolocated in the United States. DNS resolution uses the Cloudflare‑provided authoritative name servers mallory.ns.cloudflare.com and rohin.ns.cloudflare.com. The web server returns HTTP 403, and the TLS certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid certificate chain but not confirming legitimacy of the host content. The page title observed during the brief crawl reads “Official Site Pre‑Sale (with up to 200% Bonus)”, a phrasing commonly associated with fraudulent token‑sale promotions.

Automated analysis detected the presence of Cloudflare Browser Insights and the generic Cloudflare platform, but no additional third‑party frameworks. Reputation services place the domain on three security blocklists and record explicit blocks from PhishDestroy, MetaMask, and SEAL. VirusTotal scans show six of ninety‑three AV engines flagging the domain, reinforcing the suspicion of malicious intent. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating.

The domain is currently offline, which may be a temporary takedown or a deliberate shutdown after detection. While the exact content of the site has not been captured, the combination of a brand‑impersonation label (“across”), a high‑yield pre‑sale claim, and the observed technical indicators strongly suggests a phishing or investment‑fraud scheme targeting users searching for legitimate “across” services. Defenders should continue to block the IP address 104.21.48.49 at the network perimeter, add xaionchain.com to URL filtering lists, and monitor the associated Cloudflare name servers for any re‑registration attempts.