att[.]ilkkd[.]cc

Analysis of the domain att.ilkkd.cc shows it was created on 21 February 2026 and resolves to the IPv6 address 2606:4700:3034::6815:4769, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The TLS certificate presented for the host is listed as “WE1”, a generic certificate that provides no organisational validation. VirusTotal records detections from 15 of 93 scanned security vendors, indicating that a notable minority of scanners have flagged the domain as malicious. The Gridinsoft trust score is 0 / 100, reinforcing the assessment of high risk.

The domain appears on one external security blocklist and has been actively blocked by the PhishDestroy mitigation service. Current probes indicate the host is offline, suggesting the operator has temporarily taken the site down, but the underlying Cloudflare front‑end and IPv6 address remain reachable and could be re‑activated at any time. No page title, brand identifier, or phishing‑kit details have been observed in the available intelligence, so the exact lure or target brand cannot be confirmed. Nonetheless, the combination of recent registration, low‑trust SSL, multiple vendor detections, inclusion on a phishing‑specific blocklist, and the presence of a Cloudflare‑hosted address satisfies criteria for an elevated‑risk phishing infrastructure.

Defenders should add the fully qualified domain name att.ilkkd.cc and its IPv6 address to network‑level deny lists, configure DNS resolvers to block queries for the domain, and monitor traffic to the associated Cloudflare address for any re‑appearance. Email security gateways should be instructed to quarantine messages that contain URLs resolving to this domain, and user awareness training should highlight the possibility of future campaigns employing similar sub‑domains. Continuous re‑scanning with sandbox and URL‑reputation services is recommended to capture any changes if the site is re‑hosted or the certificate is renewed.