att[.]lhjrt[.]cc

The domain att.lhjrt.cc is currently listed as offline but retains observable indicators of a high‑risk brand‑impersonation campaign targeting x.com. Registration data shows the domain was created on 2026-02-21 through Gname.com Pte. Ltd., and it resolves to the Cloudflare address 104.21.3.186, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. DNS records list the authoritative nameservers emely.ns.cloudflare.com and matias.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. No TLS certificate is presented; HTTP requests return the default nginx page with the title “Welcome to nginx!”, indicating that no custom landing page is currently served.

The site appears on one security blocklist and is flagged by Google Safe Browsing for social engineering. VirusTotal analysis shows that 15 of 93 security vendors have marked the domain as malicious, providing independent corroboration of its abusive nature. The Gridinsoft trust score is 0 out of 100, and PhishDestroy has already blocked the domain, reinforcing the consensus that the domain is being used for brand‑impersonation. Because the site is offline and the HTTP response is the generic nginx placeholder, the exact content served to victims cannot be confirmed at this time.

No SSL certificate means encrypted traffic is not available for inspection, and the lack of a custom page prevents verification of the specific phishing workflow. Defenders should continue to block att.lhjrt.cc at perimeter and DNS layers, monitor for any re‑activation of the domain, and add the IP address 104.21.3.186 to threat‑intel feeds if not already present. Email security gateways should enforce strict brand‑authentication checks for communications purporting to originate from x.com, and users should be warned about unsolicited links referencing the domain. Ongoing reconnaissance of the Cloudflare‑hosted infrastructure may reveal additional sub‑domains or related indicators.