att[.]psiew[.]cc

This domain, att.psiew.cc, is a confirmed phishing site designed to impersonate x.com, the social media platform. The site attempts to deceive users into entering their login credentials by mimicking the appearance and functionality of the legitimate x.com login page. Once entered, these credentials are harvested by threat actors for unauthorized account access, financial fraud, or further phishing campaigns targeting the victim's contacts. The site may also distribute malware under the guise of a required software update or verification process, increasing the risk of device compromise and data exfiltration. Analysis indicates this domain was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domains. The site resolves to the IP address 104.21.94.40, hosted on Cloudflare’s infrastructure (AS13335), which is commonly abused to mask the true origin of phishing operations. At the time of assessment, 19 out of 95 security vendors on VirusTotal flagged this domain as malicious, with detections including phishing, brand impersonation, and fraudulent activity. The domain appears on one security blocklist, and Google Safe Browsing has explicitly labeled it as a phishing threat. Notably, the site lacks an SSL certificate, which is unusual for legitimate login portals and serves as a red flag for users. The page title, 'Welcome to nginx!', suggests misconfigured or hastily deployed server infrastructure, further indicating malicious intent. If you or someone in your organization visited att.psiew.cc, immediate action is required to mitigate potential damage. First, do not enter any credentials or personal information on the site. If credentials were already submitted, assume they are compromised and reset passwords for x.com and any other accounts using the same credentials. Enable multi-factor authentication (MFA) on all critical accounts to prevent unauthorized access. Scan the device used to access the site for malware using updated security software, as phishing pages may deploy malicious payloads. Monitor accounts for suspicious activity, such as unauthorized posts, messages, or password change requests. Report the incident to your organization’s security team or a trusted cybersecurity professional for further investigation. Additionally, consider reporting the domain to the registrar (Gname.com Pte. Ltd.) and hosting provider (Cloudflare) to aid in takedown efforts and prevent further abuse.