att[.]hfnir[.]cc

The domain att.hfnir.cc was identified as a phishing site that impersonated legitimate services. It received a low trust score of 15/95 on VirusTotal, which indicates a high likelihood of fraudulent activities. The page title, 'Welcome to nginx!', suggests that it may have been used to deceive users into providing sensitive information under the guise of legitimacy.

This domain was registered recently, just 3 days ago, through Gname.com Pte. Ltd., a registrar based in the US. Its infrastructure is hosted on an IP address of 172.67.149.237 and has been blocklisted once, indicating malicious behavior associated with it. This recent registration adds to the suspicious nature of the domain and suggests it may have been set up specifically for a phishing campaign.

Currently, att.hfnir.cc is inactive, and PhishDestroy has already reported the domain and taken necessary steps to ensure it cannot be accessed. Continuous monitoring will be maintained to prevent any potential resurgence of this threat.