atw[.]gg

Analysis indicates that the domain atw.gg is currently classified as a high‑risk generic phishing vector. The site returns an HTTP 301 redirect and advertises the page title “ATW.GG”. It is listed on a security blocklist and has been cited in a single AlienVault OTX pulse. The domain was registered on 2026-05-02 and remains active.

Infrastructure inspection shows the domain resolves to 104.21.0.175, an address owned by Cloudflare, Inc., located in CA. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, confirming the use of a legitimate certificate chain. The recent registration date aligns with typical phishing deployment timelines.

Reputation metrics are uniformly negative. Gridinsoft assigns a trust score of 0/100, and eight of ninety‑five VirusTotal scanners have flagged the host as malicious. The domain appears on the PhishDestroy blocklist, confirming active mitigation by external defenders. No additional intelligence such as specific malware families or command‑and‑control behavior has been observed.

Uncertainty remains regarding the exact phishing content delivered after the redirect, as the landing page was not captured in this analysis. Defenders should immediately block DNS resolution and HTTP traffic to atw.gg, enforce TLS inspection to observe post‑redirect payloads, and monitor for any use of the associated IP address in other campaigns. Continuous re‑evaluation is advised as new indicators may emerge.