xa200g[.]icu

This domain, xa200g.icu, was created on February 21, 2026 and registered through NiceNIC International Group Co., Limited. It is currently marked as offline, and the PhishDestroy service has taken the site down. Authoritative nameservers gordon.ns.cloudflare.com and shaz.ns.cloudflare.com resolve the domain to the Cloudflare‑hosted address 172.67.135.252, which is associated with ASN 13335 and geolocated to the United States. No TLS certificate is presented, indicating that the site does not support HTTPS and would rely on unencrypted HTTP connections.

The only publicly observed artifact is the page title “XA200G Official Pre‑Sale — Get Up to 200% Bonus!”, a phrasing commonly used in fraudulent promotional offers to lure victims into providing personal or financial information. The domain appears on a single security blocklist and has been flagged by the PhishDestroy mitigation platform. VirusTotal analysis shows that 15 of 93 scanning engines returned a malicious classification, providing independent corroboration of malicious intent. The elevated risk rating reflects the combination of a fresh registration, lack of encryption, and the presence of a deceptive page title.

Because the site is offline, active content inspection is not possible, leaving the exact phishing vector, targeted brand, or credential‑capture method unverified. Defenders should enforce DNS‑level blocking of xa200g.icu, add the associated Cloudflare IP address to network deny lists, and continue to monitor for any re‑registration or reuse of the same nameserver pair. Integration of this indicator into threat‑intel feeds and periodic re‑scanning of the IP address are recommended to detect potential resurgence of the infrastructure.