xa70t[.]icu

Analysis of xa70t.icu shows a domain that was created on February 21, 2026 and is registered through NiceNIC International Group Co., Limited. The site was observed to serve a page with the title "XA70B Official Pre-Sale — Get Up to 200% Bonus!" and does not present an SSL certificate, indicating it operates over plain HTTP. DNS resolution points to the IP address 188.114.97.3, which belongs to the Cloudflare network (AS13335) and is located in the United States. The authoritative nameservers are faye.ns.cloudflare.com and trace.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure.

The domain currently reports an offline status and is listed on a single security blocklist; it is specifically blocked by PhishDestroy. VirusTotal scans have recorded 12 detections out of 95 security vendors, providing independent confirmation of malicious activity. No additional threat intelligence such as Safe Browsing verdicts, OTX references, or detailed malware kit identifiers is available in the current dataset.

The presence of a high‑value promotional title, lack of transport encryption, and multiple vendor detections collectively suggest a phishing campaign targeting users with a pre‑sale incentive. Defenders should consider adding xa70t.icu to network blocklists, monitoring DNS queries for the associated Cloudflare IP, and enforcing TLS‑only policies to mitigate exposure to similar unsecured domains. Continuous observation of the domain’s status and any future re‑activation is recommended, as the offline state may be temporary.