xonedium[.]icu

The domain xonedium.icu was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently taken offline. The site presented the page title "Xonedium - Trade smart, not hard new ERC-20 tokens - powered by OpenAI," indicating a cryptocurrency‑focused lure. No SSL certificate was observed, meaning the site operated without HTTPS encryption. DNS resolution points to the single IPv4 address 172.67.137.225, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States.

The authoritative nameservers are javon.ns.cloudflare.com and sydney.ns.cloudflare.com, both Cloudflare‑managed, suggesting the infrastructure was leveraged for rapid deployment and potential obfuscation. Security‑vendor analysis on VirusTotal recorded five detections out of ninety‑three scanners, confirming that multiple anti‑malware engines identified malicious behavior. The domain appears on one external blocklist and has been added to the PhishDestroy blocklist, reinforcing its classification as a phishing resource. While the page content has not been directly inspected, the combination of a cryptocurrency‑themed title, lack of TLS, and detection by reputable scanners aligns with the generic phishing profile supplied.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as no additional indicators such as phishing form URLs or malware hashes were disclosed. Defenders should continue to block the domain at perimeter firewalls and DNS filtering solutions, monitor for any residual traffic to the associated Cloudflare IP, and consider adding the IP address to threat‑intel feeds. Ongoing observation of the registrar NiceNIC and the Cloudflare nameservers may reveal future re‑use of the infrastructure for related campaigns. Organizations should educate users about unsolicited offers involving new ERC‑20 tokens and advise verification of any OpenAI‑related claims before entering credentials.