att[.]kgeyu[.]cc

Analysis of the domain att.kgeyu.cc was performed on July 23, 2026. The domain is currently offline, which suggests the operators have taken the site down after detection. The domain was registered on March 2, 2026 through Gname.com Pte. Ltd., a registrar that is frequently used for short‑lived malicious infrastructure. DNS resolution points to the IP address 172.67.173.162, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are benedict.ns.cloudflare.com and melinda.ns.cloudflare.com, confirming that the domain relied on Cloudflare’s DNS and CDN services. No TLS certificate was presented for the site, indicating that the service was delivered over plain HTTP.

An HTTP request to the host returned the default server banner “Welcome to nginx!”, which is a generic response and provides no indication of the intended phishing content. Google Safe Browsing has classified the URL as a social‑engineering threat, and the domain appears on a single security blocklist. PhishDestroy also listed the domain as blocked. VirusTotal recorded 18 detections out of 93 scanned security vendors, reinforcing the view that the domain was used for malicious purposes. The available evidence confirms that att.kgeyu.cc was employed in a generic phishing campaign, but the specific target brand, credential‑capture page layout, or lure technique has not been disclosed in the collected data.

Consequently, defenders cannot attribute the campaign to a particular industry or victim profile beyond the generic phishing classification. The lack of a TLS certificate and the use of a default Nginx page suggest that the malicious site may have been a temporary drop‑off point for redirects or payload delivery rather than a fully crafted phishing landing page.