att[.]qatio[.]cc

Analysis of the domain att.qatio.cc shows a newly registered site created on February 21, 2026 that has been taken offline as of the report date. The domain resolves to the IP address 172.67.161.61, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. Nameserver records point to henry.ns.cloudflare.com and ulla.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. The registrar listed is Gname.com Pte. Ltd. No TLS certificate is presented; the HTTP response returns the default "Welcome to nginx!" page title, indicating that no custom web content was observed before the takedown.

Threat intelligence flags the site as a brand‑impersonation campaign targeting x.com. Twelve of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single external blocklist. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. PhishDestroy has already blocked the domain, and the current status is offline, suggesting the operators have withdrawn the site, possibly to avoid further detection.

Uncertainty remains around any payload or credential‑harvesting infrastructure that may have been hosted behind the domain before takedown, as no further page content or redirects were captured. Defenders should continue to block the IP 172.67.161.61 at the network perimeter, add att.qatio.cc to local and cloud‑based URL filtering lists, and monitor for re‑registration of similar sub‑domains under the same registrar or using the same Cloudflare nameservers. Ongoing scrutiny of Cloudflare‑hosted assets targeting the x.com brand is advised, as the infrastructure could be repurposed for future impersonation attempts.