att[.]hsxmg[.]cc

Analysis of att.hsxmg.cc indicates that the domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare infrastructure (nameservers alfred.ns.cloudflare.com and nancy.ns.cloudflare.com, ASN 13335). DNS resolution points to the IP address 188.114.96.3, which is geolocated to the United States and belongs to Cloudflare, Inc. The site presents the generic HTTP response title “Welcome to nginx!” and does not provide an SSL/TLS certificate, meaning traffic is served over plain HTTP. Threat intelligence flags the domain as a brand‑impersonation campaign targeting the brand x.com. The malicious activity is corroborated by a Gridinsoft trust score of 0 / 100, inclusion on a single security blocklist, and an explicit block by the PhishDestroy service.

VirusTotal scans show that 12 of 93 security vendors have flagged the domain, reinforcing the suspicion of malicious intent. The domain is currently offline, which may be a temporary takedown or an operational pause. Uncertainties remain regarding the specific payload or phishing page content, as no further forensic capture of the landing page has been reported.

The lack of an SSL certificate limits the ability to inspect encrypted traffic, but the plain‑text HTTP response and the brand‑impersonation label suggest a classic credential‑harvesting or redirection scheme. Defenders should continue to monitor the domain’s DNS records for any re‑activation, enforce blocklisting of the IP address 188.114.96.3 and the domain att.hsxmg.cc across perimeter defenses, and update email and web filtering policies to detect references to x.com that originate from this host. Incident response teams should also consider adding the domain to threat‑intel feeds and sharing the indicator with partners to prevent potential exploitation if the site resurfaces.