att[.]nfsdy[.]cc

This domain, att.nfsdy.cc, is identified as a high-risk brand impersonation phishing campaign targeting users of x.com. Analysis indicates the site was designed to mimic the legitimate platform, likely to harvest credentials or distribute malicious payloads under the guise of the targeted brand. No evidence of a cryptocurrency drainer kit was observed, but the use of brand impersonation suggests a focus on credential theft or social engineering attacks. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolves to the IP address 172.67.140.44, hosted on Cloudflare’s network (AS13335). At the time of detection, the domain was flagged by 17 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly labeling it as phishing. The domain appears on one security blocklist, and its page title, 'Welcome to nginx!', suggests either misconfiguration or an attempt to evade detection by presenting a generic server banner. No SSL certificate was observed, further reducing its legitimacy. The domain has since been taken offline, likely due to enforcement actions by hosting providers or registrars. However, the infrastructure remains a potential risk, as the IP address and registrar have been associated with prior malicious activity. Users who may have interacted with the domain are advised to reset credentials for any accounts accessed during the exposure window. Organizations should monitor for similar domains registered through the same registrar or resolving to the same IP range, as threat actors may re-deploy the campaign using new infrastructure.