trade[.]atcfx[.]com[.]bz

trade.atcfx.com.bz was observed targeting the x.com brand. The site is currently offline and returns no HTTP response, which aligns with the “taken offline” status in the intelligence feed. The only visible artifact is the page title “Just a moment…”, indicating that the domain previously served a placeholder page rather than a full credential‑capture landing page. The domain resolves to the IPv6 address 2606:4700:3034::6815:200c, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States.

No SSL certificate was presented during connection attempts, and the nameserver configuration is not available, limiting the ability to trace registration details. The domain appears on a single security blocklist and has been blocked by PhishDestroy, confirming that at least one security provider recognized it as malicious. VirusTotal analysis shows that one out of ninety‑five scanned engines reported the domain as malicious, providing a minimal but concrete detection signal. No additional evidence such as Safe Browsing, OTX, or registrar records is supplied in the current data set.

Because the infrastructure is hosted behind Cloudflare, any future re‑activation could benefit from Cloudflare’s CDN and obfuscation capabilities, complicating direct attribution. Defenders should continue to monitor the IPv6 address for re‑use, add the domain to local blocklists, and consider extending detection rules to capture similar sub‑domain patterns that target the x.com brand. Threat intelligence feeds should be updated to reflect the offline status while retaining the indicator for potential re‑deployment.