att[.]yfnvj[.]icu

Analysis as of July 23, 2026 indicates that the domain att.yfnvj.icu was registered on February 21, 2026 through Gname.com Pte. Ltd. The domain resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Both authoritative name servers—braelyn.ns.cloudflare.com and decker.ns.cloudflare.com—are Cloudflare‑managed, suggesting the infrastructure is hosted behind Cloudflare’s edge network. No SSL certificate is presented for the domain, and an HTTP request returns the default page title "Welcome to nginx!", implying the site is serving a generic Nginx landing page rather than a brand‑specific login portal.

The domain is classified as a brand‑impersonation campaign targeting x.com, and it has been placed offline at the time of this report. Detection data show that fifteen of ninety‑three VirusTotal scanners flagged the domain, and it appears on one external blocklist. The Gridinsoft trust score of 0 out of 100 further reflects a high confidence of malicious intent.

PhishDestroy has also listed the domain as blocked. Given the observed infrastructure—recent registration, Cloudflare hosting, lack of TLS, low trust score, and multiple vendor detections—defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation, and treat any traffic to att.yfnvj.icu as malicious. Attribution of the operators remains uncertain, as no additional infrastructure or payload information is available.