att[.]lcruq[.]cc

Analysis of att.lcruq.cc shows that the domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and is hosted behind Cloudflare (ASN 13335). DNS resolution points to 104.21.71.140, an IP address owned by Cloudflare, Inc. in the United States. The authoritative nameservers are edna.ns.cloudflare.com and jarred.ns.cloudflare.com. No TLS certificate is presented; HTTP requests return the default nginx welcome page with the title “Welcome to nginx!”. The lack of HTTPS combined with a generic web server banner is typical of throw‑away infrastructure used for phishing campaigns.

Reputation services provide strong evidence of malicious intent. Gridinsoft assigns a trust score of 0 out of 100. VirusTotal reports that 13 of 93 scanning engines flag the domain as malicious, and the site is listed on a single security blocklist. PhishDestroy has actively blocked the domain.

The overall risk is elevated, and the domain is currently taken offline, limiting immediate access to any payload. While the page content has not been captured, the combination of a fresh domain, Cloudflare front‑end, absence of encryption, low trust score, and multiple vendor detections strongly indicates that att.lcruq.cc was employed as a generic phishing landing page. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP address and nameservers, and consider adding the IP to reputation lists. Because the site is offline, further investigation may require archival snapshots or request‑level captures if the domain resurfaces.