att[.]avoer[.]icu

Analysis of the domain att.avoer.icu indicates it was actively impersonating the X.com platform, classified as a brand impersonation threat. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk registrations. Infrastructure analysis reveals the domain resolved to the IPv6 address 2606:4700:3036::6815:163, hosted on Cloudflare's network (AS13335) in the United States. Nameservers harlan.ns.cloudflare.com and rosalie.ns.cloudflare.com further confirm Cloudflare's involvement in its hosting infrastructure.

At the time of assessment, the domain returned an HTTP page titled 'Welcome to nginx!', a default server banner that suggests either misconfigured or placeholder content, though this does not rule out prior malicious use. Detection data shows the domain was flagged by 16 of 95 security vendors on VirusTotal, a signal of suspicious activity, though not conclusive on its own. It appeared on one security blocklist (PhishDestroy) and received a trust score of 0/100 from Gridinsoft, reinforcing its elevated risk classification. The domain lacked an SSL certificate, a red flag for fraudulent sites, particularly those impersonating established brands.

As of July 23, 2026, the domain is offline, though this status may change. Defenders should monitor for re-emergence or related infrastructure, particularly domains registered via Gname.com or hosted on Cloudflare with similar naming patterns. No evidence of a phishing kit or specific scam subtype (e.g., credential harvesting, payment fraud) is available from the current data. Further investigation into historical DNS records or archived content may clarify its operational intent.