att[.]tfigo[.]cc

The domain att.tfigo.cc was registered on 21 February 2026 through Gname.com Pte. Ltd. and immediately resolved to the Cloudflare address 172.67.150.111, which belongs to AS13335 (Cloudflare, Inc.) in the United States. The site returned the generic HTTP title “Welcome to nginx!” and did not present an SSL/TLS certificate, indicating an insecure configuration. Automated reputation services have assigned a Gridinsoft trust score of 0 out of 100, and the domain is listed on one security blocklist. Google Safe Browsing classifies the site as a social‑engineering threat, and PhishDestroy also reports it as blocked. VirusTotal analysis shows that 14 of 93 scanned security vendors flagged the domain, providing further evidence of malicious activity.

The domain is explicitly identified as a brand‑impersonation campaign targeting x.com, and the scam type is recorded as “Brand Impersonation”. Nameserver records point to benedict.ns.cloudflare.com and melinda.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. Current operational status is offline, but the retained infrastructure artefacts allow defenders to recognize the threat. The lack of a valid TLS certificate, combined with a zero trust score and multiple vendor detections, strongly suggests that the domain was used to lure victims into a credential‑harvesting flow against the x.com brand. However, because the site is no longer reachable, details of the phishing page content, payload delivery mechanisms, or credential collection endpoints remain unknown.

Defenders should continue to block the domain at perimeter filters, add the IP address 172.67.150.111 to reputation lists, and monitor for any future re‑registration of the same second‑level domain or similar sub‑domains under the same registrar. Continuous observation of Cloudflare‑hosted IP ranges for repeated abuse patterns is advised. Organizations that rely on the x.com brand should update user‑awareness training to reference att.tfigo.