att[.]hscan[.]cc

Analysis indicates that att.hscan.cc was registered on 17 January 2026 through Gname.com Pte. Ltd. The domain resolves to 172.67.160.65, an address owned by AS13335 Cloudflare, Inc., and is served behind Cloudflare’s edge network using the nameservers BILL.NS.CLOUDFLARE.COM and DONNA.NS.CLOUDFLARE.COM. The site presents an HTTP 200 response and supplies an SSL certificate issued by Google Trust Services under the WE1 label, confirming that TLS is correctly terminated. The only visible page element is the title "Welcome to nginx!", which provides no brand-specific content. The domain is flagged as a brand-impersonation of x.com, matching the supplied intelligence that the actor is targeting that brand.

Reputation metrics are poor: Gridinsoft assigns a trust score of 0/100, and PhishDestroy has already added the domain to its blocklist. VirusTotal reports that 17 of 93 scanned security vendors have identified the domain as malicious, and it appears on at least one additional public blocklist. Despite the legitimate CDN and certificate, the combination of a newly created domain, low trust score, multiple vendor detections, and explicit impersonation labeling suggests a high likelihood of malicious intent.

The exact payload or credential-collection mechanisms have not been observed; the page content beyond the title has not been captured, leaving the precise attack vector uncertain. Defenders should treat the domain as hostile, block DNS resolution and HTTP(S) access at network perimeters, and include the host in URL filtering policies. Users of x.com should be warned not to follow links to att.hscan.cc, and any suspicious communications claiming to originate from x.com that reference this domain should be reported to incident response teams for further forensic capture.