att.lydbt.cc Safety Check — Brand Impersonation

The domain att.lydbt.cc was registered on 21 February 2026 through Gname.com Pte. Ltd. and is currently listed as offline. DNS resolution points to 188.114.96.3, an address owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The authoritative name servers are henry.ns.cloudflare.com and ulla.ns.cloudflare.com, indicating that the infrastructure is hosted behind Cloudflare’s CDN. No TLS certificate is presented; HTTP requests receive the default “Welcome to nginx!” page title, suggesting the server is delivering a generic web server response rather than a targeted login portal. Threat intelligence shows the domain is classified as a brand‑impersonation campaign targeting x.com.

VirusTotal analysis flagged the domain in 12 of 93 vendor engines, and the Gridinsoft trust score is 0 / 100, reflecting a high confidence of malicious intent. The domain appears on a single external blocklist and has been actively blocked by PhishDestroy. The lack of a valid SSL certificate, combined with the generic nginx title, may be an attempt to evade automated content inspection while retaining the ability to host malicious payloads. Uncertainty remains regarding the specific payload or phishing page content because no detailed page scrape is available. Analysts cannot confirm whether credential‑stealing forms or redirect chains were present before the takedown.

The presence of Cloudflare as the front‑end service does not reveal the origin of any back‑end server that may have hosted malicious code. Defenders should add att.lydbt.cc to URL filtering rules, block the associated IP address 188.114.96.3, and monitor for any new subdomains under the same registrar or name‑server pair. Continuous observation of Cloudflare‑originating traffic for anomalous request patterns is advised. Updating endpoint protection and email security gateways with the observed VirusTotal detection signatures will help reduce exposure to any future re‑use of this infrastructure.