att[.]ludyz[.]cc

Analysis of the domain att.ludyz.cc confirms its classification as a brand-impersonation phishing site targeting X.com, with elevated risk indicators and recent takedown. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., and was actively resolving to IP address 172.67.188.204, hosted on Cloudflare's infrastructure (AS13335) in the United States. Nameservers edna.ns.cloudflare.com and jarred.ns.cloudflare.com further tie the domain to Cloudflare's network, a common pattern observed in phishing campaigns leveraging CDN services for anonymity and resilience. Detection data from July 23, 2026, shows the domain is flagged by 16 of 93 security vendors on VirusTotal, a clear indication of malicious classification. It is also listed on the PhishDestroy blocklist, reinforcing its status as a confirmed phishing threat. The domain's Gridinsoft trust score of 0/100 aligns with these findings, reflecting high confidence in its malicious nature.

At the time of assessment, the domain was offline, displaying only an 'Welcome to nginx!' default page title, which suggests either a recent takedown or temporary suspension of the phishing operation. No SSL certificate was detected, a common omission in low-effort phishing sites but not conclusive on its own. Infrastructure analysis reveals the use of Cloudflare's IP space, which is frequently exploited to obscure the true origin of malicious domains. While the domain's registration details are consistent with known phishing tactics—such as the use of a privacy-focused registrar and rapid deployment post-registration—the absence of an active phishing kit or detailed page content limits further technical attribution. The scam type is explicitly classified as brand impersonation, targeting X.com, though no additional evidence (e.g., page screenshots, kit signatures, or user reports) is available to confirm the exact methods of exploitation.

Defenders should treat att.ludyz.