att[.]fyiqw[.]icu

Analysis of att.fyiqw.icu conducted on July 23, 2026 indicates that the domain was created on February 21, 2026 and is presently taken offline. The authoritative nameservers are harlan.ns.cloudflare.com and rosalie.ns.cloudflare.com, which resolve the domain to the Cloudflare edge address 104.21.94.196 located in the United States under ASN 13335 (Cloudflare, Inc.). No TLS certificate is presented, and the HTTP response returns the default Nginx welcome page with the title "Welcome to nginx!", suggesting a bare‑bones web server rather than a crafted phishing landing page. Security‑vendor scans on VirusTotal show that 16 of 95 AV engines flag the domain, and the Gridinsoft trust score is 0 / 100, reflecting a high confidence of malicious intent.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation platform. Registration was performed through Gname.com Pte. Ltd., a registrar known to host abusive domains. The listed scam type is "Brand Impersonation" and the target brand is identified as x.com, indicating that the domain was likely intended to mimic or lure victims of that service. Because the site is offline, live content cannot be examined, and the absence of an SSL certificate prevents verification of any credential‑harvesting forms.

Defenders should continue to block the domain at network perimeters and update URL filtering lists to include att.fyiqw.icu. Monitoring of the associated IP address (104.21.94.196) is advisable, as Cloudflare may host additional abusive subdomains sharing the same edge node. Threat‑intel feeds should be refreshed to capture any re‑activation of the domain or emergence of related infrastructure. Uncertainty remains regarding the exact phishing payload or landing page, as no page content beyond the Nginx title has been captured.