att[.]rusyv[.]cc

Analysis of att.rusyv.cc indicates a confirmed brand impersonation campaign targeting X.com, with infrastructure characteristics consistent with phishing activity. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., and currently resolves to 188.114.97.3, a Cloudflare IP (AS13335) located in the US. No SSL certificate is present, increasing the risk of unencrypted credential interception. The page title, 'Welcome to nginx!', suggests a default or misconfigured server, which may indicate either an incomplete setup or an attempt to evade detection by presenting minimal content. Security vendor coverage is limited but indicative: 15 of 93 engines on VirusTotal flagged the domain as malicious, and it appears on one security blocklist.

The domain is also blocked by PhishDestroy, further corroborating its malicious classification. Gridinsoft assigns a trust score of 0/100, reinforcing the elevated risk assessment. Nameservers lennon.ns.cloudflare.com and noor.ns.cloudflare.com are associated with Cloudflare, a common hosting choice for both legitimate and malicious domains, which may complicate takedown efforts. Defenders should treat this domain as a confirmed phishing threat targeting X.com users.

The lack of SSL, minimal detection coverage, and default server banner do not diminish the risk; such characteristics are often observed in low-sophistication or early-stage campaigns. While the domain is currently offline, monitoring for re-activation or related infrastructure (e.g., sibling domains on the same IP or registrar) is recommended. Blocking the domain at DNS and proxy levels, as well as alerting on any connections to 188.114.97.3, will mitigate potential exposure. No evidence of a phishing kit or additional page content is available for further classification.