attmailgood[.]square[.]site

The domain attmailgood.square.site was registered on February 5, 2019 through MarkMonitor Inc., a registrar often associated with high‑profile brands. Its authoritative name servers are ns-1248.awsdns-28.org, ns-1816.awsdns-35.co.uk, ns-311.awsdns-38.com, and ns-810.awsdns, indicating that the domain is hosted on Amazon Web Services infrastructure. DNS resolution points to the IPv4 address 74.115.51.5, which is consistent with AWS‑owned address blocks. On 29 July 2026, multiple security services flagged the domain as malicious: Google Safe Browsing classifies it as a social‑engineering threat, and the PhishDestroy blocklist actively blocks it. VirusTotal reports that 17 of 91 scanned security vendors have flagged the domain, demonstrating a moderate level of consensus among detection engines. The domain also appears on at least one additional blocklist, reinforcing its reputation as a high‑risk resource.

No public evidence about the site’s SSL/TLS configuration, HTTP status codes, page title, or phishing kit has been disclosed, leaving the exact nature of the displayed content uncertain. Likewise, there is no available analysis of the page’s content or any observed credential‑harvesting behavior. The lack of detailed page‑level intelligence means that defenders cannot confirm which brand or service the site purports to imitate, only that it is categorized as a generic phishing operation.

Given the confirmed indicators—registrar, AWS name servers, IP address, multiple vendor detections, Google Safe Browsing social‑engineering flag, and inclusion on PhishDestroy—security teams should treat attmailgood.square.site as a high‑confidence malicious indicator. Recommended actions include adding the domain and its resolved IP to outbound and inbound DNS blocklists, enforcing URL filtering policies that deny access to the address, and monitoring network traffic for connections to 74.115.51.5.