att[.]qxout[.]cc

This domain is flagged for elevated-risk brand impersonation targeting X.com users. The infrastructure is designed to deceive visitors into submitting authentication credentials through a fraudulent login interface, a common precursor to account takeover and subsequent malicious activity such as spam propagation or financial fraud. Analysis of att.qxout.cc reveals multiple technical indicators of compromise. The domain was registered on February 21, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate services. It resolves to IP address 104.21.68.80, hosted on Cloudflare's network (AS13335), which is frequently exploited to mask origin servers. The page displays a default 'Welcome to nginx!' title, suggesting either misconfiguration or an incomplete deployment intended to evade detection. VirusTotal reports 17 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Notably, no SSL certificate is present, increasing the likelihood of interception during credential transmission. Mitigation requires a multi-layered approach. Network administrators should implement DNS-based blocking for att.qxout.cc and its resolved IP 104.21.68.80 at perimeter security controls. Endpoint protection systems should be updated to detect and prevent access to the domain. Users should be educated to verify URL authenticity before entering credentials, particularly for services like X.com, and to inspect for HTTPS indicators. Organizations should monitor for authentication attempts originating from the domain or its associated infrastructure. Given the domain's current offline status, continuous monitoring is advised to detect potential reactivation or migration to alternative hosting.