att[.]rkgub[.]cc

Analysis of att.rkgub.cc indicates that the domain is currently offline, which limits real‑time verification of its content. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare’s network (ASN 13335) with the IP address 104.21.72.117 located in the United States. Both authoritative nameservers are cash.ns.cloudflare.com and nancy.ns.cloudflare.com, confirming that the domain relies on Cloudflare’s DNS and edge services. No TLS certificate is presented for the host, and an HTTP request returns the default page title “Welcome to nginx!”, a generic server banner that does not reveal any branding or malicious payload.

Threat intelligence flags the domain as a brand‑impersonation campaign targeting x.com. VirusTotal has recorded detections from 16 of 93 security vendors, suggesting that multiple scanners have identified malicious characteristics. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy service. Additionally, Gridinsoft assigns a trust score of 0 out of 100, indicating a high confidence of abuse.

Because the site is offline, the exact payload or phishing kit cannot be confirmed, and the lack of a certificate prevents inspection of encrypted traffic. Nevertheless, the combination of a recent registration date, Cloudflare‑based hosting, multiple vendor detections, a zero trust rating, and the specific brand‑impersonation label provides sufficient evidence for defensive operators to treat att.rkgub.cc as a malicious resource. Recommended actions include adding the domain to internal blocklists, monitoring any future DNS resolution attempts, and ensuring that security solutions that reference VirusTotal, PhishDestroy, or Gridinsoft trust scores flag the domain as high‑risk. Continuous observation of the IP address 104.21.72.117 for other suspicious activity is also advised, as Cloudflare often serves multiple unrelated domains.