att[.]xnduw[.]icu

Analysis conducted on July 23, 2026 indicates that the domain att.xnduw.icu was registered on February 21, 2026 and currently resolves to the Cloudflare‑owned address 104.21.52.194 (AS13335, United States). The hosting provider is Cloudflare, Inc., which is commonly abused for fast‑flux and proxy services. The TLS certificate presented by the site is identified as "WE1", confirming that HTTPS is enabled but providing no further validation of the operator’s identity. VirusTotal has recorded detections from 17 of 95 scanned security vendors, demonstrating a consensus that the domain is associated with malicious activity.

Independent blocklist services have also flagged the domain: PhishDestroy lists it as blocked, Gridinsoft assigns a trust score of 0 out of 100, and at least one additional security blocklist includes the domain. The overall risk rating is elevated, and the infrastructure is presently taken offline, which may be a temporary takedown or a deliberate shutdown. While the available data confirms the domain’s involvement in generic phishing, the specific payload, targeted brand, or phishing kit has not been disclosed in the public indicators. No Safe Browsing, Open Threat Exchange, or registrar‑level intelligence has been released, leaving the exact modus operandi and victim profile uncertain.

Defenders should continue to block DNS resolution for att.xnduw.icu at the network perimeter and enforce HTTPS inspection where possible to capture any residual traffic. Security teams should also monitor for re‑registration of the domain or emergence of similar sub‑domains under the same registrar, and incorporate the observed indicator set (IP 104.21.52.194, SSL WE1, detection count) into threat‑intel feeds. Ongoing vigilance is advised given the recent creation date and the active detection by multiple vendors.