att[.]com-egd[.]icu

This domain is flagged as a high-risk brand impersonation threat targeting X.com users. Analysis indicates the infrastructure is designed to deceive visitors into submitting authentication credentials through a fraudulent login interface, leveraging the trusted reputation of the legitimate platform to facilitate credential theft. Infrastructure analysis reveals the domain att.com-egd.icu was registered on February 21, 2026, through NameMart Pte. Ltd., an uncommon registrar for legitimate corporate domains. It resolves to IP address 104.21.47.143 (AS13335 Cloudflare, Inc.), a hosting provider frequently abused for malicious campaigns. The domain appears on 1 security blocklist, is flagged by Google Safe Browsing as phishing, and is detected by 18 out of 95 security vendors on VirusTotal. The SSL certificate is absent, and the page title displays 'Welcome to nginx!', a default server banner indicating minimal effort to mask malicious intent. The domain is currently offline but was actively blocked by PhishDestroy prior to takedown. Mitigation requires immediate action from security teams and end users. Network administrators should enforce DNS-level blocking of att.com-egd.icu and monitor for connections to 104.21.47.143. Endpoint protection systems should be updated to detect and prevent access to domains registered through NameMart Pte. Ltd. with creation dates in early 2026, particularly those impersonating social media platforms. Users who may have visited the domain should reset X.com credentials from a secure device and enable multi-factor authentication. Security awareness training should emphasize the risks of domains mimicking brand names with appended random strings (e.g., 'egd') or unusual TLDs.