att[.]ogriu[.]icu

att.ogriu.icu was registered on 17 January 2026 through Gname.com Pte. Ltd. and immediately pointed to the IP address 172.67.180.203, which belongs to Cloudflare (AS13335) located in the United States. The domain resolves to a server that returns the default “Welcome to nginx!” page and does not present an SSL certificate, indicating that no HTTPS service was configured at the time of analysis. The site is classified as a brand‑impersonation campaign targeting x.com, and the scam type is explicitly listed as “Brand Impersonation” in the intelligence feed. VirusTotal records show that 14 out of 95 scanning engines flagged the domain, reflecting a moderate level of malicious detection. Gridinsoft assigned a trust score of 0 / 100, and the domain appears on a single external security blocklist.

PhishDestroy has taken the domain offline, and current monitoring indicates the site is no longer reachable. The authoritative nameservers are A.SHARE-DNS.COM and B.SHARE-DNS.NET, both typical of shared DNS hosting services. Evidence confirms that the infrastructure is built on a Cloudflare edge network, a common choice for fast‑flux or temporary phishing deployments because it masks the true origin of the content. The lack of TLS, the generic nginx landing page, and the low trust score suggest that the site was either a placeholder or an abandoned phishing front. The precise content of the page beyond the title has not been captured, so the exact phishing payload or credential‑harvesting mechanisms remain unknown.

Defenders should continue to block att.ogriu.icu at the network perimeter and add the domain to DNS‑based blocklists used by endpoint protection solutions. Because the domain is hosted on a shared Cloudflare IP, future sub‑domains could be activated by the same threat actor; continuous passive DNS monitoring for the IP 172.67.180.203 and the associated nameservers is advised. Organizations that use x.