att[.]xgnie[.]icu

att.xgnie.icu was registered on 21 February 2026 through Gname.com Pte. Ltd. The domain resolves to 172.67.146.122, an address owned by Cloudflare (AS13335) located in the United States. Authoritative name‑servers are seamus.ns.cloudflare.com and simone.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The site presented the HTTP response “Welcome to nginx!” and did not serve an SSL/TLS certificate, indicating an unencrypted web server. The page title is limited to “Welcome to nginx!” and provides no further content, suggesting that the payload was either removed or never deployed.

The infrastructure is flagged as a brand‑impersonation campaign targeting x.com, and the domain appears on one external security blocklist and has been blocked by PhishDestroy. VirusTotal analysis shows that 11 of 93 scanning engines flagged the domain, reflecting a mixed detection profile. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious classification. The domain is currently listed as offline, but the underlying Cloudflare IP and name‑server configuration remain active and could be reused for future campaigns.

Defenders should add att.xgnie.icu to URL filtering and DNS blocklists, monitor for re‑registration or similar sub‑domains, and consider correlating internal logs for any recent requests to the IP address or host header. Continuous ingestion of threat‑intel feeds that reference this seed (197d84) will help surface any re‑emergence of the infrastructure. Given the observed indicators, proactive containment is advised.