xeraxium[.]icu

The domain xeraxium.icu was registered through NiceNIC International Group Co., Limited on 27 February 2026. The authoritative nameservers are dante.ns.cloudflare.com and elisa.ns.cloudflare.com, indicating that the domain is served behind Cloudflare's network (ASN 13335, United States). DNS resolution points to IP address 104.21.48.228, a Cloudflare edge node commonly used for hosting malicious infrastructure. No TLS certificate is presented for the domain, confirming that it does not provide HTTPS protection. Analysis of public threat feeds shows that xeraxium.icu appears on a single security blocklist and is actively blocked by the PhishDestroy service.

VirusTotal reports that one of ninety‑three scanned security vendors flagged the domain, providing an additional indicator of malicious intent. The only visible page title associated with the domain is “xeraxium.live/form/subscribe.php”, which suggests the site hosts a form‑based endpoint typically used in credential‑harvesting campaigns, although the content of the page has not been captured. The current operational status is listed as offline, meaning the site is no longer reachable at the time of reporting. However, the historical evidence—recent registration, Cloudflare hosting, lack of encryption, detection by a blocklist, and a vendor flag—supports the assessment that the domain was employed for a generic phishing campaign.

Uncertainty remains regarding the specific target audience, the phishing kit employed, and whether additional sub‑domains were used. Defenders should add xeraxium.icu to their deny lists, enforce DNS‑level blocking, and monitor outbound traffic for connections to the associated Cloudflare IP 104.21.48.228. Incident response teams should also review logs for any attempts to contact the domain prior to its takedown and consider broader Cloudflare edge IP ranges as potentially malicious if similar patterns emerge.