xaifox[.]icu

The domain xaifox.icu was registered on 21 February 2026 through NiceNIC International Group Co., Limited. It resolves to the public IP address 188.114.96.3, which is owned by Cloudflare, Inc. (ASN 13335) and located in the United States. DNS resolution is handled by the Cloudflare nameservers carlane.ns.cloudflare.com and randy.ns.cloudflare.com, indicating that the operator is using Cloudflare’s CDN and DDoS‑mitigation services. The website presented the page title “XAIFOX Official Pre‑Sale – Get Up to 200% Bonus!” but no SSL certificate was observed, leaving the connection unencrypted.

The site has been taken offline and is currently listed as inactive. Threat intelligence feeds show that the domain appears on one security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal analysis recorded 16 positive detections out of 93 scanning engines, reinforcing the malicious assessment. No additional evidence such as Safe Browsing entries, OTX references, or public malware hashes were supplied.

The combination of a recent domain registration, use of a reputable CDN to hide hosting, a compelling pre‑sale title, lack of HTTPS, and multiple vendor detections suggests a typical phishing or fraudulent lure aimed at enticing victims with inflated bonuses. Defenders should continue to block traffic to 188.114.96.3 when it appears in the context of xaifox.icu, update URL filtering and email security policies to deny references to this domain, and monitor any future re‑registration attempts. Because the site is already offline, immediate remediation focus should be on preventing reuse of the same infrastructure, especially the Cloudflare‑hosted IP address, and on sharing the observed indicators with relevant threat‑sharing platforms.