aftoll[.]icu

Analysis of the domain aftoll.icu indicates it was a phishing site operating with elevated risk before being taken offline on or before July 23, 2026. The domain was registered on February 24, 2026, through NiceNIC International Group Co., Limited, and resolved to the IP address 212.22.90.25, hosted by New Hosting Technologies LLC (AS216334) in Russia. Infrastructure checks reveal the domain used nameservers a.dnspod.com, b.dnspod.com, and c.dnspod.com, a common configuration for domains linked to malicious activity. At the time of assessment, eight of ninety-three security vendors on VirusTotal flagged aftoll.icu as malicious, though the specific nature of the threat—such as credential harvesting, fraudulent transactions, or other phishing tactics—remains unconfirmed due to the site being offline.

The domain appeared on one security blocklist, specifically PhishDestroy, reinforcing its classification as a phishing threat. No SSL certificate was detected, which is atypical for legitimate sites and further supports the domain’s suspicious status. Defenders should treat this domain as compromised infrastructure.

Network-level blocking of 212.22.90.25 and monitoring for related domains using the same nameservers or registrar is recommended. Since the domain is offline, no live content analysis is possible, and the exact brand or service it targeted cannot be determined from available data. Historical logs or proxy data may provide additional context if this domain was encountered in enterprise or consumer environments prior to takedown.