att[.]edlcp[.]cc

Analysis of att.edlcp.cc shows a recently registered domain (created 21 Feb 2026) that is currently offline but was previously flagged for brand impersonation of x.com. The domain is hosted behind Cloudflare’s network (ASN 13335) and resolves to IP 172.67.144.36, a Cloudflare edge node located in the United States. DNS resolution uses Cloudflare’s authoritative nameservers alfred.ns.cloudflare.com and nancy.ns.cloudflare.com, indicating the attacker leveraged Cloudflare’s free DNS service to obscure the true origin. No TLS certificate was presented during the brief capture, and the HTTP response returned the generic “Welcome to nginx!” title, suggesting a default web server configuration rather than a crafted login portal. The registrar listed is Gname.com Pte. Ltd., a known bulk‑registration provider often abused for malicious campaigns.

Threat intelligence sources have placed the domain on at least one public security blocklist and it has been actively blocked by the PhishDestroy feed. VirusTotal scans recorded 12 positive detections out of 93 submitted engines, reinforcing the suspicion of malicious intent. Additionally, Gridinsoft assigned a trust score of 0 / 100, indicating a high likelihood of abuse. The combination of a brand‑impersonation claim, low trust score, multiple vendor detections, and rapid takedown aligns with typical infrastructure used for credential‑stealing or phishing operations targeting users of x.com.

Uncertainty remains regarding the exact content that was served before the takedown; the captured page title provides no evidence of a replica login page or malicious payload. Consequently, defenders cannot confirm the specific phishing vector but should treat the domain as hostile.