att[.]kjfdj[.]icu

att.kjfdj.icu was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolved to the Cloudflare address 104.21.66.42, belonging to AS13335 (Cloudflare, Inc.) in the United States. The domain is configured with Cloudflare’s default nameservers raina.ns.cloudflare.com and scott.ns.cloudflare.com. No TLS certificate is presented; HTTP requests return the default "Welcome to nginx!" page title, indicating an uncustomized web server. Threat intelligence flags the site as a brand‑impersonation campaign targeting x.com.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal analysis recorded 15 detections out of 93 scanning engines, confirming malicious classification by multiple vendors. PhishDestroy has already blocked the domain, and the current status is listed as offline.

The available evidence does not reveal the specific phishing kit, landing page content, or credential‑capture mechanisms, leaving those aspects uncertain. Defenders should continue to monitor the associated IP address for any re‑use, enforce blocklisting of the domain and its resolved IP, and update web filtering rules to include the observed hostnames. Additional investigation should focus on harvesting any URLs or payloads that may have been served before takedown, and corroborating the activity with other threat feeds that reference the same IP or registrar.