att[.]zsdif[.]cc

Analysis of att.zsdif.cc shows a classic brand‑impersonation infrastructure targeting the X.com brand. The domain was registered on February 21, 2026 through Gname.com Pte. Ltd. and resolves to the Cloudflare IP address 172.67.185.88, hosted in the United States under ASN 13335 (Cloudflare, Inc.). Both authoritative name servers, edna.ns.cloudflare.com and jarred.ns.cloudflare.com, are Cloudflare‑managed, indicating the use of a reputable CDN for fast DNS resolution.

No TLS certificate is presented; the HTTP response returns the generic “Welcome to nginx!” page title, confirming a lack of encryption and suggesting a placeholder page rather than a crafted phishing login. The domain has been flagged by 14 of 93 VirusTotal security vendors and appears on one external blocklist. PhishDestroy has already taken the site offline, and the Gridinsoft trust score is 0 / 100, reinforcing the malicious classification.

While the site is currently inaccessible, its infrastructure—Cloudflare edge hosting, rapid domain creation, and the absence of a valid certificate—matches patterns observed in other brand‑impersonation campaigns. Defenders should ensure that att.zsdif.cc is added to URL filtering and DNS‑block lists, monitor for any re‑registration or similar domains using the same IP range, and enforce transport‑layer security policies that block unencrypted HTTP connections to unknown hosts. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related indicators.