att[.]vnijsabs[.]cc

The domain att.vnijsabs.cc has been identified as a brand impersonation threat targeting X.com (formerly Twitter). Analysis confirms the domain was designed to mimic legitimate X.com authentication portals, likely for credential theft or account compromise. As of the latest verification, the domain has been taken offline, though residual risk may persist due to prior exposure. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on January 17, 2026, an unusually future-dated entry suggesting potential data manipulation or misreporting. It resolved to the IP address 104.21.22.96, hosted on Cloudflare’s network (AS13335), a common tactic to obscure origin infrastructure. The domain was flagged by 17 of 95 VirusTotal security vendors, indicating moderate detection coverage. No SSL certificate was present, further reducing legitimacy. The domain appeared on one security blocklist, and its page title, 'Welcome to nginx!', suggests a misconfigured or placeholder server, typical of hastily deployed phishing infrastructure. Current status confirms att.vnijsabs.cc is offline, though organizations should remain vigilant for re-emergence under similar naming conventions or infrastructure. Defenders are advised to block the domain and its resolved IP at network perimeters, monitor for related subdomains or typosquatting variants, and alert users to the impersonation risk. Historical logs should be reviewed for connections to 104.21.22.96 or the domain itself. Given the Cloudflare hosting, additional scrutiny of traffic to AS13335 may uncover related malicious activity. Users who interacted with the domain should reset credentials, enable multi-factor authentication, and scan systems for unauthorized access.