att[.]nkguw[.]icu

This domain, att.nkguw.icu, is identified as a brand impersonation phishing site designed to deceive users of X.com, a major social media platform. The site likely presented itself as a legitimate login portal or promotional page to harvest credentials, personal information, or facilitate unauthorized account access. Given the domain's association with a well-known brand, the risk of successful deception is elevated, particularly among users who may not scrutinize URLs or SSL certificate presence closely. Analysis indicates the domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently observed in phishing infrastructure. The site resolved to IP address 188.114.97.3, hosted under AS13335 (Cloudflare, Inc.), a common proxy service used to obscure malicious origins. No SSL certificate was present, a red flag for users expecting encrypted connections. VirusTotal detections show 18 out of 95 security vendors flagged the domain as malicious, reinforcing its classification as a confirmed threat. The page title, 'Welcome to nginx!', suggests either misconfigured or intentionally minimalistic hosting, often seen in hastily deployed phishing campaigns. Users who visited att.nkguw.icu should assume potential exposure of credentials or personal data. Immediate actions include resetting passwords for X.com and any accounts sharing the same credentials, enabling multi-factor authentication where available, and monitoring accounts for unauthorized activity. Device scans for malware are recommended, as phishing sites may redirect to exploit kits or download malicious payloads. If financial or sensitive information was entered, affected parties should report the incident to relevant authorities and consider credit monitoring services. Network administrators should block the domain and associated IP (188.114.97.3) at the firewall or DNS level to prevent further access.