att[.]ixqvu[.]cc

Analysis of att.ixqvu.cc indicates the domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and is hosted behind Cloudflare’s network (ASN 13335). DNS resolves to 172.67.189.136, an IP address assigned to Cloudflare, Inc. in the United States. The authoritative name servers are alexia.ns.cloudflare.com and josh.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. No TLS certificate is presented; HTTP requests return the default “Welcome to nginx!” page title, suggesting the site is either a placeholder or deliberately left blank.

The domain is flagged as a brand‑impersonation scam targeting x.com, and it has been added to at least one security blocklist, where it is listed as blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, indicating a high confidence of malicious intent. VirusTotal analysis shows that 13 of 93 scanning engines have reported the domain as malicious, providing independent vendor corroboration. The site is currently offline, and no further content has been observed.

Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑appearance of content, and add the IP address 172.67.189.136 to any relevant deny lists, recognizing that the address is shared among many Cloudflare customers. Because the site lacks a valid SSL certificate and serves only the default nginx banner, any attempt to use it for credential harvesting would rely on other mechanisms not yet identified. Ongoing observation of the registrar and name‑server configuration is advised, as changes could indicate a re‑activation of the phishing infrastructure.