att[.]ejpqu[.]cc

The domain att.ejpqu.cc is identified as a brand impersonation threat specifically targeting x.com, the social media platform. Analysis indicates the domain was designed to mimic legitimate login pages, likely to harvest user credentials or facilitate unauthorized account access. As of the latest assessment, the domain has been taken offline, though its infrastructure remains documented for investigative purposes. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolved to the IP address 172.67.188.24, hosted on Cloudflare’s network (AS13335). The domain is flagged by 17 of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. The page title, 'Welcome to nginx!', suggests a misconfigured or placeholder server, which may indicate either an incomplete deployment or an attempt to evade detection. No SSL certificate was observed, further reducing its apparent legitimacy. At present, att.ejpqu.cc is offline, though its historical activity warrants continued monitoring. Organizations and users are advised to block the domain at the network level and review logs for prior connections. Security teams should treat any residual references to this domain as malicious and investigate associated IP addresses for lateral movement or persistence. Proactive measures, such as domain-based email filtering and endpoint detection rules, are recommended to mitigate similar threats targeting brand impersonation.