att[.]hfnir[.]cc

att.hfnir.cc was observed as a brand‑impersonation infrastructure targeting the x.com brand. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare (ASN 13335) with the IP address 172.67.149.237 located in the United States. The authoritative nameservers are dell.ns.cloudflare.com and julian.ns.cloudflare.com. No TLS certificate is presented; HTTP requests return the default nginx page with the title “Welcome to nginx!”.

The site has been taken offline at the time of analysis, but historical data show that it was listed on at least one security blocklist and actively blocked by the PhishDestroy service. Google Safe Browsing classifies the URL as a social‑engineering threat, and Gridinsoft assigns a trust score of 0 / 100. VirusTotal reports that 15 of 93 scanning engines flagged the domain, indicating a moderate level of detection across the community. The domain appears on a single external blocklist, which further corroborates its malicious nature.

Because the site is currently offline, real‑time probing is not possible, and the exact phishing page content remains unverified beyond the generic nginx title. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurrection of the host under the same IP or similar sub‑domains, and add the domain to internal allow‑list exceptions only after thorough re‑evaluation. Ongoing threat‑intel feeds should be consulted for any new indicators that may emerge, especially if the domain is re‑registered or the IP is reused for additional impersonation campaigns.