att[.]vmoyq[.]cc

Analysis of the domain att.vmoyq.cc indicates it was actively impersonating the social media platform x.com as recently as July 23, 2026. The domain, registered on February 21, 2026, through Gname.com Pte. Ltd., resolved to the IP address 172.67.132.66, hosted on Cloudflare's network (AS13335) in the United States. No SSL certificate was detected, increasing the risk of unencrypted credential harvesting. The page title 'Welcome to nginx!' suggests a default server configuration, often observed in hastily deployed phishing infrastructure.

At the time of assessment, the domain was flagged by 12 of 95 security vendors on VirusTotal and appeared on the PhishDestroy blocklist, confirming its classification as brand impersonation. The domain has since been taken offline, though its prior hosting on Cloudflare nameservers (bill.ns.cloudflare.com and donna.ns.cloudflare.com) and lack of legitimate branding align with known phishing patterns. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification.

While the exact content of the site remains unanalyzed, the combination of a default nginx page, absence of encryption, and blocklist presence strongly suggests it was designed to harvest user credentials under the guise of x.com. Defenders should treat this domain as compromised and monitor for related infrastructure, particularly domains registered through the same registrar or resolving to the same IP range. Given its offline status, no immediate user interaction risk exists, but historical logs should be reviewed for exposure.