att[.]ogjur[.]icu

This domain, att.ogjur.icu, poses a targeted brand impersonation threat designed to exploit Apple’s reputation. Analysis indicates the site presents itself as an AT&T holiday deals page, a tactic commonly used to trick users into entering sensitive credentials or financial details under the guise of exclusive offers. The domain’s infrastructure and content are engineered to create a false sense of legitimacy, increasing the likelihood of successful deception, particularly during high-traffic shopping periods. Infrastructure analysis reveals multiple red flags confirming malicious intent. The domain was registered on February 21, 2026, an unusually future-dated creation that aligns with known evasion techniques to bypass automated detection systems. It resolves to IP address 104.21.7.90, hosted on Cloudflare’s network (AS13335), a common obfuscation method to mask the true origin of the attack. The SSL certificate, issued under the WE1 authority, is a low-assurance certificate often associated with short-lived phishing campaigns. VirusTotal detections further validate the threat, with 18 out of 95 security vendors flagging the domain as malicious. Additionally, the domain appears on one security blocklist and was proactively blocked by internal monitoring systems. Users who visited att.ogjur.icu should take immediate remediation steps to mitigate potential compromise. First, terminate any active sessions with the site and clear all browser data, including cookies and cached files, to remove residual tracking mechanisms. If credentials or payment details were entered, reset passwords for all associated accounts, prioritizing Apple ID, email, and financial services. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Monitor financial statements for unauthorized transactions and report any suspicious activity to the relevant institution. For enterprise environments, isolate any endpoints that accessed the domain and conduct a full forensic analysis to detect potential lateral movement or data exfiltration. Given the elevated risk level, affected users should assume their credentials are compromised and act accordingly.