att[.]sgnju[.]cc

att.sgnju.cc was registered on 21 February 2026 through Gname.com Pte. Ltd. The domain resolves to the IPv6 address 2606:4700:3037::6815:382b, which is owned by Cloudflare, Inc. (ASN 13335) and geolocated to the United States. No TLS certificate is presented; HTTP requests return the default “Welcome to nginx!” page title, indicating an unconfigured web server rather than a crafted login portal. The site is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy feed. Google Safe Browsing classifies the URL as a social‑engineering threat, and nine of ninety‑three VirusTotal scanners have raised detections, reinforcing the suspicion of malicious intent.

Gridinsoft assigns a trust score of 0 / 100, and the domain is currently offline, suggesting that the malicious infrastructure has been taken down or temporarily disabled. The domain claims to impersonate the brand x.com, a known target for credential‑harvesting campaigns, but no further artefacts—such as phishing pages, credential‑capture forms, or malicious payloads—have been publicly released. Consequently, the exact attack vector and victim interaction flow remain uncertain.

Defenders should continue to block the domain and its associated IPv6 host at network perimeters, enforce DNS filtering for the x.com brand, and monitor for any re‑hosting of the same sub‑domain pattern under the same Cloudflare nameservers (emely.ns.cloudflare.com, matias.ns.cloudflare.com). Because the infrastructure relies on Cloudflare’s shared network, additional domains leveraging the same AS may appear; threat‑intel teams should therefore correlate any future detections with the observed IP range and registrar details. Ongoing reconnaissance is recommended to capture any redeployment attempts and to update detection rules with the observed indicators of compromise.