att[.]znkde[.]icu

Analysis as of July 24, 2026 indicates that the domain att.znkde.icu was registered on February 21, 2026 and is currently taken offline. The domain resolves to the Cloudflare‑owned address 104.21.28.49, located in the United States under ASN 13335. The SSL certificate presented for the host is identified as “WE1”, which is typical of automatically issued certificates for Cloudflare‑protected sites. Independent scanning services have flagged the host; 18 of 95 VirusTotal scanners reported detections, and the domain appears on a single external blocklist.

PhishDestroy has explicitly blocked the host, reinforcing the malicious classification. A Gridinsoft trust score of 0 out of 100 further reflects a lack of reputational confidence. The available intelligence does not include a page title, brand target, or specific kit fingerprint, leaving the exact phishing payload undefined. However, the combination of a newly created domain, low trust score, SSL certificate issuance, and multiple vendor detections aligns with a generic phishing operation.

Defenders should add att.znkde.icu to network‑level deny lists, enforce DNS sink‑hole redirection, and monitor for any resurrection attempts on the underlying IP address. Continuous re‑query of public blocklists and VirusTotal is advised to capture future changes in status. Organizations that rely on Cloudflare‑proxied services should verify that internal clients are not inadvertently resolving to this address, and consider applying URL filtering policies that reference the domain’s known malicious indicators. Until the host is definitively removed from the threat landscape, a precautionary block is recommended.