att[.]hrgup[.]cc

The domain att.hrgup.cc was observed targeting the brand x.com through a brand impersonation scheme. The domain was registered on 17 January 2026 via Gname.com Pte. Ltd., and its DNS is served by A.SHARE-DNS.COM and B.SHARE-DNS.NET. An SSL certificate identified as WE1 is present, and the HTTP response returns the generic title “Welcome to nginx!”. The site is hosted behind Cloudflare, resolving to IP address 172.67.143.195, which is allocated to AS13335 in the United States. Security telemetry shows the domain has been blocked by PhishDestroy and appears on a single security blocklist. Gridinsoft assigns it a trust score of 0 out of 100.

VirusTotal analysis recorded detections from 15 of 93 scanning engines, indicating a moderate level of malicious confidence. The current operational status is offline, suggesting the hosting has been taken down or the site has been disabled. No content analysis of the landing page is available beyond the title, and no specific login or credential‑harvesting forms have been captured. Consequently, the exact tactics used to lure victims remain unknown. The presence on only one public blocklist does not preclude additional undisclosed listings, and the low Gridinsoft score reflects a consensus of high risk. The brand target x.com is explicitly noted, confirming the impersonation intent.

The lack of a custom page title suggests the site may have been a placeholder or a quickly deployed infrastructure, a pattern observed in other brand‑impersonation campaigns. Given the short lifespan from registration to detection (approximately six months), threat actors appear to be leveraging fast‑flux style deployment, taking advantage of Cloudflare’s CDN to obscure origin. Analysts should continue to block the domain and its resolving IP at network perimeter devices, add the domain to URL filtering and reputation lists, and monitor for any re‑registration attempts.