att[.]vdjiw[.]icu

Analysis of att.vdjiw.icu indicates the domain was registered on 21 February 2026 and is hosted on Cloudflare infrastructure (AS13335) with the address 172.67.151.221 located in the United States. The domain is currently taken offline, but historical observations show it was classified as generic phishing and assigned an elevated risk rating. Detection engines on VirusTotal flagged the domain in 17 of 93 scans, demonstrating moderate consensus among security vendors that the site is malicious.

The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. Its SSL certificate is identified as WE1, and the Gridinsoft trust score is 0 out of 100, indicating a lack of trustworthiness. The combination of recent creation, low trust score, and multiple vendor detections suggests the infrastructure was likely used for credential harvesting or fraudulent credential collection before being taken down.

Defenders should continue to enforce DNS and proxy filtering rules that block the domain and the associated IP address, monitor for any resurgence of the host on other blocklists, and consider adding the IP to internal deny lists. Incident response teams should also verify that no internal credentials have been compromised and, if any suspicious activity is observed, initiate standard credential reset and forensic procedures. Ongoing threat‑intelligence feeds should be consulted for any future re‑registration attempts that reuse the same sub‑domain pattern.