att[.]com-jxb[.]icu

This domain, att.com-jxb.icu, is identified as a high-risk phishing infrastructure designed for brand impersonation, specifically targeting users of X.com (formerly Twitter). Analysis indicates the site mimics legitimate X.com login portals to harvest credentials, though no drainer kit signatures were detected in initial scans. The page title 'Welcome to nginx!' suggests misconfigured or deliberately obfuscated server infrastructure, a common tactic in phishing campaigns to evade detection during early deployment phases. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameMart Pte. Ltd., an uncommon registrar for legitimate services. It resolves to IP address 104.21.63.185, hosted on Cloudflare’s network (AS13335), which is frequently abused for anonymization. Google Safe Browsing has flagged the domain as phishing, and it appears on one security blocklist. VirusTotal reports 20 out of 95 security vendors detecting malicious activity, with no SSL certificate present, further reducing trust indicators for potential victims. As of the latest verification, att.com-jxb.icu has been taken offline, likely due to enforcement actions from hosting providers or registrars. However, residual risk remains, as threat actors may re-deploy similar infrastructure using newly registered domains or altered IP addresses. Users who interacted with the site should assume credential exposure and initiate password resets on X.com, while enabling multi-factor authentication. Organizations are advised to monitor for related domains registered under the same registrar or resolving to the same IP range, as this campaign may represent a broader credential harvesting operation.