xai-network[.]icu

PhishDestroy identifies xai-network.icu as a live domain engaged in active brand impersonation targeting Sui. With a status marked as 'active' and threat type classified as brand impersonation, this domain poses a credible risk to users expecting legitimate Sui services. The campaign is currently under investigation while adversaries leverage deceptive tactics to harvest credentials or facilitate crypto drainer operations.

This domain resolves to IP 188.114.97.3 and is flagged by 7 of 95 VirusTotal vendors, indicating an emerging threat that has evaded detection. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 01, 2026, the domain also holds an SSL certificate issued by Google Trust Services, further enhancing its deceptive legitimacy. Despite zero detections, the lack of historical blocklist entries suggests this campaign may be in early deployment phases.

Users and organizations are advised to block xai-network.icu at the network perimeter immediately. DNS sinkholing or firewall rules should be implemented to prevent access, while security teams should monitor outbound connections to the associated IP (188.114.97.3). Given the domain’s recent registration and low detection rate, heightened scrutiny during domain and SSL certificate validation is strongly recommended to mitigate potential credential theft or crypto asset loss.