att[.]rgnjk[.]cc

att.rgnjk.cc was registered on 21 February 2026 and resolves to the Cloudflare address 172.67.187.161, an IP associated with AS13335 in the United States. The domain has been classified as a generic phishing site and is currently taken offline. VirusTotal analysis shows that nine out of ninety‑three antivirus and URL‑reputation scanners flagged the domain as malicious, indicating a non‑trivial detection rate. The site is listed on at least one public blocklist and has been explicitly blocked by the PhishDestroy community blocklist.

TLS negotiation presents a certificate labeled “WE1”, which does not correspond to a trusted public‑CA chain and further reduces confidence in the site’s legitimacy. No additional metadata such as page title, targeted brand, or phishing kit has been released, so the exact content of the malicious page remains unknown. Infrastructure analysis confirms that the hosting provider is Cloudflare, a common choice for fast‑flux and anonymized phishing infrastructure. The single blocklist entry currently referencing the domain originates from a collaborative phishing mitigation feed, which indicates early detection by community defenders.

Given the elevated risk rating, the domain should be treated as a high‑confidence indicator of compromise. Defenders should add att.rgnjk.cc to URL filtering and DNS sinkhole rules, monitor traffic to the hosting IP 172.67.187.161 for anomalous connections, and enforce TLS inspection policies to detect the untrusted “WE1” certificate. Continuous re‑evaluation is advised in case the domain is re‑activated, and security teams should correlate any future alerts with the known blocklist entries and VirusTotal detections.