att[.]zjhvi[.]cc

The domain att.zjhvi.cc was registered on February 21, 2026 through Gname.com Pte. Ltd. and resolves to the IP address 188.114.96.3, which is hosted by Cloudflare, Inc. (AS13335) and located in the United States. Its authoritative nameservers are coco.ns.cloudflare.com and miles.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. The site currently returns the generic HTTP page title "Welcome to nginx!" and does not present an SSL/TLS certificate, suggesting the web server is either misconfigured or deliberately serving an unencrypted page. Google Safe Browsing classifies the domain as social engineering, and VirusTotal reports that 15 of 93 security vendors have flagged the host, reinforcing the suspicion of malicious activity.

The Gridinsoft trust score of 0 out of 100 provides an additional quantitative indicator of low credibility. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. The threat taxonomy supplied labels the activity as a brand impersonation targeting x.com, and the domain is marked offline at the time of reporting.

While the limited public surface—only a default nginx title and no SSL—precludes confirmation of a functional phishing page, the convergence of multiple independent detections (Safe Browsing, VirusTotal, blocklist, and PhishDestroy) establishes a high confidence that att.zjhvi.cc is being used for brand impersonation. Defenders should immediately block the domain and its resolving IP at perimeter firewalls and DNS filters, monitor for any new sub‑domains under the same registrar or Cloudflare account, and consider adding the host to internal threat intelligence feeds. Ongoing observation of Cloudflare‑hosted assets linked to the same nameservers may reveal additional malicious infrastructure, and any future attempts to serve TLS‑encrypted content should be re‑evaluated for possible escalation.