att[.]jowek[.]cc

This report analyzes the domain att.jowek.cc, which was configured to impersonate the brand x.com. The site presented a default "Welcome to nginx!" page title, indicating no functional content was served, but its classification as an impersonation scam suggests it was designed to deceive visitors into believing they were interacting with a legitimate x.com service. The primary threat posed is social engineering, as flagged by Google Safe Browsing, which could lead to credential theft or other fraudulent activities.

Technical evidence shows the domain was flagged by 19 out of 95 VirusTotal vendors, with detections from ADMINUSLabs, Criminal IP, BitDefender, Chong Lua Dao, and Cluster25. Google Safe Browsing explicitly flagged the site for SOCIAL_ENGINEERING. The domain was registered through Gname.com Pte. Ltd. and created on 2026-02-21, with an IP address of 104.21.13.143 hosted in the United States under AS13335 Cloudflare, Inc. The site lacked SSL certification and used nameservers cory.ns.cloudflare.com and gemma.ns.cloudflare.com.

As of analysis, the domain is DOWN/OFFLINE, rendering it inaccessible. However, its DOM risk score of 10 and GridinSoft trust rating of 0 out of 100 indicate a high-risk profile. The domain remains on 1 blocklist, and due to its impersonation nature and confirmed social engineering flag, it poses a significant threat to potential visitors, particularly those expecting legitimate x.com services.