att[.]mrqvs[.]cc

The domain att.mrqvs.cc was registered on February 21, 2026 through Gname.com Pte. Ltd. and is currently listed as offline. DNS resolution points to the IP address 188.114.97.3, which belongs to the Cloudflare network (AS13335, United States). The domain is served by two Cloudflare authoritative nameservers, alfred.ns.cloudflare.com and nancy.ns.cloudflare.com, indicating that the attacker leveraged Cloudflare’s DNS and CDN services to obscure the true hosting location. No SSL certificate is presented, and an HTTP request returns the default "Welcome to nginx!" page, confirming the presence of a generic web server with no TLS encryption.

Security intelligence flags the site as a brand impersonation campaign targeting the brand x.com. The Gridinsoft trust score is 0 out of 100, reflecting a maximum risk rating. The domain appears on a single external blocklist, specifically PhishDestroy, which has actively blocked the host. VirusTotal analysis shows that 14 of 95 scanning engines identified the domain as malicious, providing independent vendor corroboration of its illicit nature.

While the available data confirms the infrastructure, the specific payload, phishing kit, or compromised credentials have not been observed, leaving the exact attack vector uncertain. Defenders should immediately add att.mrqvs.cc to network deny lists and block the associated IP 188.114.97.3 at perimeter firewalls. Continuous monitoring of Cloudflare‑associated IP ranges for similar patterns is advised, as the attacker may repurpose the same CDN edge for future campaigns. Future investigations should request full page content, capture any redirected URLs, and verify whether the domain was ever configured with TLS to assess potential credential harvesting tactics.