xaa222[.]icu

Analysis of the domain xaa222.icu shows that it was registered on 21 February 2026 through NiceNIC International Group Co., Limited and currently resolves to the IP address 188.114.96.3, which is owned by Cloudflare, Inc. (AS13335) and geolocated in the United States. The domain’s DNS is served by gordon.ns.cloudflare.com and shaz.ns.cloudflare.com. No SSL certificate is presented for the site, indicating that connections are not encrypted. The public page title retrieved before the site was taken offline reads “XA200G Official Pre‑Sale — Get Up to 200% Bonus!”, a phrasing commonly used in promotional or fraudulent campaigns.

The infrastructure has been flagged by a commercial blocklist and is listed as offline by the PhishDestroy sinkhole. VirusTotal scans indicate that 12 out of 93 security vendors classified the domain as malicious, suggesting a moderate consensus among scanning engines. The domain appears on a single external blocklist, reinforcing its suspicious reputation. Because the site is currently offline, active content cannot be inspected, and no further technical artifacts such as JavaScript payloads, credential‑stealing forms, or redirects have been observed.

The lack of HTTPS, combined with the promotional page title and vendor detections, points toward a likely phishing or scam operation that was active for a short period after registration. Defenders should continue to block traffic to xaa222.icu at network borders, add the domain and its resolving IP to reputation‑based deny lists, and monitor for any re‑registration or resurrection of similar Cloudflare‑hosted domains. Ongoing threat‑intel feeds should be consulted for updates, and any internal alerts that reference the domain’s page title or associated IP should be investigated promptly.