att[.]kgiow[.]icu

The domain att.kgiow.icu was observed to resolve to the IP address 104.21.43.220, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. The domain was registered on 21 February 2026 and its SSL certificate is identified as WE1, indicating that a valid TLS certificate is in place. VirusTotal records show that nine out of ninety‑three scanning engines flagged the domain as malicious, reflecting a moderate level of detection across the security community.

The domain appears on a single public blocklist and is explicitly listed by the PhishDestroy service, which classifies it as a phishing resource. Current monitoring indicates that the site is offline, which is consistent with the “taken offline” status noted in the intelligence feed. No additional artefacts such as page titles, brand references, or specific phishing kit identifiers have been disclosed, and therefore the precise content of the site remains unverified.

Nonetheless, the convergence of registration timing, Cloudflare hosting, a valid TLS certificate, multiple vendor detections, and inclusion on a dedicated anti‑phishing blocklist collectively support the conclusion that att.kgiow.icu was employed for a generic phishing campaign. Defenders should continue to enforce domain‑level blocking for att.kgiow.icu, add the associated IP 104.21.43.220 to network‑level deny lists, and monitor for any re‑use of the same infrastructure. Ongoing threat‑intel feeds should be consulted for updates, and any future resolution of the domain should trigger immediate investigation.