att[.]qcuud[.]icu

Analysis of att.qcuud.icu shows that the domain was created on 21 February 2026 and is currently taken offline. The registration was performed through Gname.com Pte. Ltd., a registrar frequently observed in malicious registrations. The domain resolves to the IP address 104.21.80.49, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Nameserver records point to annalise.ns.cloudflare.com and arnold.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. No TLS certificate is presented, indicating that the site was served over plain HTTP and returned the default “Welcome to nginx!” title, which provides no indication of the intended victim‑facing content.

The threat vector is identified as brand impersonation targeting x.com, as indicated by the supplied brand target and scam type. The domain has been flagged by 16 of 93 security vendors on VirusTotal, demonstrating a moderate consensus of malicious classification. It is listed on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole, confirming that at least one defensive network has taken mitigation actions. Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious assessment.

Given the observed infrastructure, defenders should add 104.21.80.49 to network‑level deny lists, enforce DNS blocking for att.qcuud.icu, and monitor for new domains registered by Gname.com Pte. Ltd. that resolve to Cloudflare IP ranges with similar name‑server patterns. Continuous scanning of VirusTotal and other multi‑engine platforms is recommended to capture any future re‑activations. The lack of a TLS certificate suggests that any re‑hosted payload would likely rely on HTTP, so HTTP‑only inspection rules should be applied. Because the site is already offline, immediate response actions focus on containment and prevention of re‑use of the same hosting assets.