att[.]ifukr[.]icu

Analysis indicates that att.ifukr.icu was registered on 21 February 2026 and quickly resolved to the IP address 188.114.97.3, a Cloudflare‑owned host located in the United States (AS13335). The domain appears on a single public blocklist, currently listed by PhishDestroy, and was flagged by VirusTotal where 17 of 93 scanning engines reported malicious activity. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low reputation.

The site served an SSL certificate identified as “WE1”, confirming that HTTPS was enabled before the host was taken offline. No public page title, brand reference, or detailed payload information has been released, so the exact content and lure technique remain unknown beyond the generic phishing classification. The offline status suggests that the operator may have ceased activity or is temporarily evading detection.

Defenders should treat the domain as hostile: immediately block DNS resolution and HTTP/HTTPS traffic to 188.114.97.3 for any internal client, add the domain and its IP to web‑filter and intrusion‑prevention blocklists, and monitor for future sub‑domains that share the “ifukr.icu” suffix or similar Cloudflare‑origin IP ranges. Continuous VirusTotal re‑scans and periodic checks against PhishDestroy and other blocklist feeds are recommended to capture any re‑activation. Given the low trust score and multiple vendor detections, the risk of credential harvesting or other credential‑related abuse is elevated, and incident response teams should be prepared to investigate any authentication attempts that originate from this host.