att[.]lgncu[.]cc

att.lgncu.cc was observed targeting users of the x.com brand through a brand‑impersonation campaign. The domain was registered on 21 February 2026 via Gname.com Pte. Ltd. and is hosted behind Cloudflare’s network (ASN 13335). DNS resolution returns the IPv6 address 2a06:98c1:3120::3, which is geolocated to the United States. Both authoritative name servers are eugene.ns.cloudflare.com and olivia.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. No TLS certificate is presented; HTTP responses return the default nginx page with the title “Welcome to nginx!”, indicating that the site is either misconfigured or deliberately left without a valid certificate.

The malicious infrastructure has been detected by several security vendors. VirusTotal records show that 18 of 95 scanners flagged the domain, and the site is listed on a single external blocklist. PhishDestroy has also added the domain to its blocklist, providing additional confirmation of its malicious intent. The Gridinsoft trust score of 0 / 100 further reflects a high likelihood of abuse. The campaign’s current status is offline, suggesting that the operator has taken the site down or the hosting provider has removed it.

Open questions remain regarding the specific phishing kit or page content, as the only retrieved HTTP response is the generic nginx welcome page. No SSL certificate or custom landing page was captured, limiting insight into credential‑stealing mechanisms. Analysts should continue to monitor the domain’s DNS records for re‑activation and watch for any resurgence of related sub‑domains. Defensive actions include adding att.lgncu.cc to local block lists, updating intrusion detection signatures that reference the observed Cloudflare IP range and nameservers, and ensuring that any outbound traffic to the IPv6 address 2a06:98c1:3120::3 is inspected. Organizations that rely on the x.