atroposia[.]com

Analysis of atroposia.com, observed on July 24 2026, indicates an active generic phishing site. The domain was registered on February 21 2026 through NiceNIC International Group Co., Limited. DNS resolution points to 188.114.96.3, an address owned by AS13335 Cloudflare, Inc., located in the United States. Both authoritative nameservers are Cloudflare (cruz.ns.cloudflare.com, kirk.ns.cloudflare.com). The site serves HTTP status 200 and presents the page title “Atroposia”.

TLS termination is provided by a Google Trust Services certificate (WE1), confirming a valid SSL chain. Technology fingerprints include YouTube embeds, Cloudflare Browser Insights, Cloudflare CDN, and HTTP/3 support. The domain is listed on a single security blocklist and has been flagged by PhishDestroy. VirusTotal scans show that 2 of 93 security vendors have raised detections, confirming some level of malicious classification. No additional public threat‑intel feeds such as OTX or Google Safe Browsing entries were cited in the available data.

The combination of recent registration, Cloudflare‑hosted infrastructure, active TLS, and limited but non‑zero vendor detections suggests a deliberately provisioned phishing operation rather than an abandoned or test domain. Defenders should add atroposia.com to URL filtering and endpoint blocklists, monitor network traffic for connections to 188.114.96.3, and enforce TLS inspection to capture any credential exfiltration attempts. Because the site currently returns a valid page with the title “Atroposia”, users may be directed from malicious emails or messages that reference the same term, so user awareness training should reference the exact domain name. Continuous re‑evaluation is advised, as additional detections may appear on broader blocklists or security vendors.