att[.]fohad[.]cc

This domain, att.fohad.cc, is identified as a brand impersonation phishing infrastructure targeting users of x.com. Analysis indicates the domain was designed to deceive visitors into believing they were interacting with the legitimate x.com platform, likely to harvest credentials or distribute malicious payloads. No explicit crypto drainer kit signatures were detected, but the absence of an SSL certificate and the presence of a generic nginx welcome page suggest early-stage deployment or a placeholder configuration prior to full malicious activation.

Technical indicators confirm elevated risk: the domain was registered on January 20, 2026, through Gname.com Pte. Ltd., and resolves to IP address 104.21.3.148, hosted on Cloudflare’s network (AS13335). VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious, while it appears on one additional security blocklist. The domain lacks an SSL certificate, further reducing legitimacy. No detections were recorded on Google Safe Browsing at the time of analysis, though this may reflect delayed reporting rather than benign status.

The domain is currently offline, likely due to takedown actions or voluntary suspension by the registrar. Despite its inactive status, residual risk remains for users who may have been exposed prior to deactivation. Organizations are advised to block the domain across all security layers, including DNS filtering, email gateways, and endpoint protection. Network defenders should monitor for residual connections to the associated IP (104.21.3.148) and investigate any historical interactions with the domain in logs or proxy data. Users who accessed the domain should assume credential exposure and initiate password resets on x.com and any other platforms where identical credentials may have been reused.