att[.]owdgn[.]cc

The domain att.owdgn.cc was registered on 21 February 2026 through Gname.com Pte. Ltd. and delegated to the Cloudflare resolver nameservers merlin.ns.cloudflare.com and rafe.ns.cloudflare.com. DNS resolution points to IP address 104.21.36.158, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented; HTTP requests return the default "Welcome to nginx!" page, indicating an unconfigured web server rather than a crafted phishing landing page. The site is listed on a single security blocklist and has been actively blocked by the PhishDestroy feed, confirming that defensive operators have taken it offline.

VirusTotal analysis shows 14 of 93 scanning engines flagging the domain, reinforcing the suspicion of malicious intent. Gridinsoft’s trust scoring system assigns a rating of 0 out of 100, the lowest possible score, further indicating a high confidence of abuse. The domain is explicitly marked as a brand‑impersonation campaign targeting the brand x.com, although no additional content or credential‑harvesting pages have been captured for forensic review.

The current offline status limits immediate observation of payload or credential capture mechanisms, leaving the exact phishing workflow uncertain. Defenders should continue to enforce blocklisting of att.owdgn.cc and its associated IP address, monitor for any re‑registration or infrastructure changes, and incorporate the domain’s indicators into network and email filtering rules. Periodic re‑query of VirusTotal and other reputation services is advised to capture any future detections, and security teams should remain vigilant for similar Cloudflare‑hosted domains that exhibit default server signatures and lack TLS, as these characteristics have proven common in brand‑impersonation operations.