att[.]afrxe[.]cc

Analysis of the domain att.afrxe.cc, observed on July 23, 2026, indicates an active brand‑impersonation campaign aimed at users of x.com. The domain was registered on February 21 2026 through Gname.com Pte. Ltd. and is hosted on Cloudflare infrastructure (AS13335), resolving to the IP address 188.114.96.3 located in the United States. DNS resolution points to the Cloudflare nameservers marek.ns.cloudflare.com and savanna.ns.cloudflare.com. No TLS certificate is presented; HTTP requests return the default “Welcome to nginx!” page title, suggesting the server is serving an unconfigured nginx instance rather than a crafted login portal.

Threat intelligence aggregators have flagged the domain: VirusTotal reports 16 of 95 security vendors as positive, Gridinsoft assigns a trust score of 0 / 100, and the domain appears on a single external blocklist. The phishing‑defense service PhishDestroy has already taken the domain offline and marks it as blocked. The current status is listed as offline, indicating that the malicious site is no longer reachable at the time of analysis. The available evidence confirms the use of the domain for brand impersonation, but the specific content served, credential‑stealing mechanisms, or any associated malware payload remain unknown because the site returns only a generic nginx banner.

Consequently, defenders cannot attribute additional indicators such as malicious URLs, scripts, or phishing emails to the domain at this stage. Recommendations: security teams should continue to block att.afrxe.cc at network perimeter and DNS layers, monitor for any resurgence of the domain or similar sub‑domains hosted on the same IP range, and incorporate the observed indicators (registration date, registrar, IP address, and nameservers) into threat‑intel feeds. Incident response personnel should also check recent email traffic for references to x.