att[.]gddiv[.]icu

The domain att.gddiv.icu was registered on February 21, 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare infrastructure (ASN 13335) with the IP address 104.21.56.131 located in the United States. DNS resolution points to the Cloudflare nameservers harlan.ns.cloudflare.com and rosalie.ns.cloudflare.com. No TLS certificate is presented; HTTP requests return the default nginx page titled "Welcome to nginx!" indicating the site is not serving the expected brand content. The domain is classified as a brand‑impersonation campaign targeting the brand x.com, as explicitly noted in the intelligence feed.

PhishDestroy has already blocked the domain, and it appears on one external security blocklist. VirusTotal analysis shows that 15 of 93 scanning engines flagged the domain, reinforcing the malicious assessment. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating. The site is currently taken offline, but the infrastructure artifacts remain observable.

While the page content has not been captured, the combination of registrar age, Cloudflare hosting, lack of SSL, and multiple vendor detections provide strong evidence of malicious intent. Defenders should continue to block the domain at network perimeter, update URL filtering policies, and monitor for any re‑registration attempts. Additional threat‑intel platforms should be queried for related indicators of compromise, and any traffic observed from internal hosts to 104.21.56.131 should be investigated as potential command‑and‑control or credential‑harvesting activity.