spatt[.]icu

Analysis indicates that spatt.icu is an active phishing domain classified under generic_phishing with a high-risk designation. The domain was registered on April 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and currently resolves to the IP address 188.114.96.3, which is associated with CloudFlare, Inc. in Canada. Infrastructure analysis reveals the use of Cloudflare nameservers (gordon.ns.cloudflare.com and heidi.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. The domain is flagged on one security blocklist and appears in a single AlienVault OTX threat intelligence pulse, suggesting recent malicious activity. The SSL certificate is issued by Google Trust Services (WE1), which does not inherently indicate legitimacy, as phishing sites frequently use valid certificates to appear trustworthy. The domain returns an HTTP 200 status, confirming it is actively serving content, though the exact nature of the phishing kit or targeted brand remains unconfirmed at this time. VirusTotal reports that 3 out of 91 security vendors have flagged this domain, providing further evidence of its malicious classification. Defenders are advised to block this domain at the DNS or proxy level and monitor for connections to 188.114.96.3. Given its recent registration and active status, spatt.icu may be part of a broader phishing campaign, and further investigation into associated infrastructure is recommended. No specific brand impersonation or phishing kit details are currently available, so additional analysis of the hosted content is necessary to determine the exact threat vector.