att[.]niotd[.]cc

This domain is classified as a high-risk brand_impersonation threat targeting x.com. Analysis indicates that att.niotd.cc was associated with infrastructure capable of supporting deceptive content intended to imitate the targeted brand. The domain is currently offline after being taken offline. At the time of observation, the page title was "Welcome to nginx!", suggesting a default web server page rather than legitimate branded content, although this does not reduce the significance of the associated threat indicators.

Infrastructure analysis reveals that the domain resolved to IP address 188.114.96.3, located in the US under AS13335 Cloudflare, Inc. Registration records indicate the domain was created on February 21, 2026, through Gname.com Pte. Ltd. No SSL certificate was present. Security telemetry shows the domain appears on 1 security blocklist and is specifically blocked by PhishDestroy. Google Safe Browsing classifies the domain as phishing. Reputation data further indicates that 17 of 95 VirusTotal security vendors flag the domain, supporting the high-risk assessment.

Although the domain is no longer active, historical indicators should remain blocked because similar infrastructure may be reused in future campaigns. Organizations should retain detections for the domain and IP address, review DNS, proxy, and endpoint logs for prior access, and investigate any authentication attempts or sensitive data submissions associated with this domain. Users who interacted with the site should change exposed credentials, review account activity for unauthorized access, and remain alert for follow-on brand impersonation attempts using related domains or infrastructure.