att[.]sbkft[.]icu

Analysis of att.sbkft.icu indicates a high‑risk brand‑impersonation campaign targeting the x.com brand. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to the IP address 188.114.96.3, which is hosted by Cloudflare (AS13335) in the United States. Both authoritative name servers – brady.ns.cloudflare.com and love.ns.cloudflare.com – resolve to Cloudflare infrastructure, suggesting the attacker is leveraging a reputable CDN to hide the true origin of the payload. The site presents the generic HTTP response “Welcome to nginx!” and does not provide an SSL/TLS certificate, confirming that the service is delivered over plain HTTP.

Google Safe Browsing classifies the domain as a social‑engineering threat, and the PhishDestroy blocklist has already flagged it. In addition, the domain appears on one additional security blocklist, and sixteen of ninety‑five VirusTotal scanners have marked the host as malicious, reinforcing the suspicion of malicious intent. The Gridinsoft trust score of 0 / 100 further confirms the lack of legitimacy. No content analysis beyond the page title is available, so the exact phishing page layout, credential‑capture mechanisms, or payload delivery vectors remain unknown.

Defenders should immediately block outbound connections to 188.114.96.3 at the network perimeter, add att.sbkft.icu to DNS‑based blocklists, and monitor for any sub‑domain generation under the same Cloudflare name servers. Since the domain is currently offline, continuous observation of its registration status and potential re‑activation is advisable. Organizations that use the x.com brand should reinforce user awareness training to recognize unsolicited communications that reference “x.com” and verify URLs before entering credentials. Threat‑intel teams should enrich this indicator with any future URL paths, payload samples, or phishing email artifacts that may surface.