att[.]ddkir[.]icu

Analysis of att.ddkir.icu indicates that the domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare infrastructure (AS13335) with the IP address 172.67.201.59 located in the United States. The authoritative nameservers are harlan.ns.cloudflare.com and rosalie.ns.cloudflare.com. No TLS certificate is presented; HTTP requests return the default “Welcome to nginx!” page title, suggesting the site is serving an unconfigured web server rather than a tailored phishing landing page. The domain is classified as a brand‑impersonation campaign targeting the X.com brand, as indicated by the supplied “Impersonates: x.com” marker and the “Scam type: Brand Impersonation” label.

Reputation signals are uniformly negative: Gridinsoft assigns a trust score of 0 out of 100, and the domain is currently listed on one security blocklist. PhishDestroy has taken the domain offline, and VirusTotal records show that 16 of 93 scanning engines flagged the domain as malicious. The combination of a recent registration, low trust score, absence of SSL, and multiple vendor detections points to a high likelihood that the domain was intended for credential‑harvesting or other fraudulent activity against X.com users.

Uncertainty remains regarding the exact payload or user‑facing content, as the visible page does not contain brand‑specific elements and no additional analysis artifacts have been released. Defenders should continue to block the IP address 172.67.201.59 and the domain att.ddkir.icu at the DNS and proxy layers, monitor for any re‑registration attempts, and update web‑gateway and endpoint protection rules with the observed threat indicators. Continuous vigilance is recommended, especially for traffic directed to X.com‑related login flows, to prevent potential future impersonation attempts.