att[.]mlaoi[.]icu

Analysis of att.mlaoi.icu indicates the domain was registered on 21 February 2026 and subsequently used for a generic phishing campaign. The domain resolves to the IP address 188.114.96.3, which is announced by Cloudflare, Inc. (AS13335) and geolocated in the United States. The host is currently taken offline, and the SSL certificate presented is identified as WE1, which does not provide a trusted chain. The site has been added to at least one public security blocklist and is actively blocked by the PhishDestroy service.

Gridinsoft assigned a trust score of 0 out of 100, reflecting the lowest possible confidence in its legitimacy. VirusTotal reports that 11 of 93 scanned security vendors flagged the domain, reinforcing the malicious classification. The domain appears on a single blocklist, but the low trust score and multiple vendor detections suggest a high likelihood of phishing activity.

Defenders should continue to enforce deny‑list rules for att.mlaoi.icu across network perimeter and endpoint controls, verify that any outbound connections to the associated IP address are blocked, and monitor for any resurgence of the domain or related infrastructure. Because the domain is already offline, investigation can focus on correlating logs for recent connections to 188.114.96.3 and on extracting any payload or credential harvesting attempts that may have been delivered before takedown. Ongoing threat‑intel feeds should be consulted for new indicators tied to the same IP range or SSL certificate, and any future registrations that reuse the same naming pattern should be scrutinized.