att[.]admsz[.]cc

att.admsz.cc was first observed on February 21, 2026 and is registered through Gname.com Pte. Ltd. The domain is delegated to the Cloudflare nameservers henry.ns.cloudflare.com and ulla.ns.cloudflare.com, and resolves to the IP address 172.67.213.136, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. No TLS certificate is presented; HTTP requests return the default nginx page with the title "Welcome to nginx!", indicating that no brand-specific landing page has been deployed at the time of analysis. The infrastructure is classified as a brand-impersonation campaign targeting the brand x.com, as indicated by the supplied intelligence.

Reputation scoring from Gridinsoft assigns a trust value of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has actively blocked the host, and 13 of 95 security vendors on VirusTotal have flagged the domain as malicious. The risk rating is elevated, although the domain is currently listed as offline.

Defenders should continue to block traffic to 172.67.213.136 and to att.admsz.cc at the network perimeter, monitor for re-appearance of the domain or similar Cloudflare-hosted sub-domains that reference x.com, and consider adding the domain to internal URL filtering and threat-intel feeds. Because the site served only a generic nginx page, no further payload or credential-harvesting infrastructure has been identified, and the exact phishing kit remains unknown. Ongoing observation is recommended to detect any future activation or changes to the hosting configuration.