att[.]zgksi[.]cc

Analysis conducted on July 23, 2026 indicates that the domain att.zgksi.cc was registered on February 21, 2026 through Gname.com Pte. Ltd. The domain resolves to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The name servers dion.ns.cloudflare.com and imani.ns.cloudflare.com confirm the use of Cloudflare’s DNS infrastructure. No TLS certificate was observed; HTTP responses return the default nginx welcome page titled "Welcome to nginx!". The lack of HTTPS and the generic server page are consistent with a placeholder or takedown state, and the domain is currently marked offline.

Security‑vendor scans on VirusTotal show that 14 of 93 engines flag the domain as malicious. Google Safe Browsing classifies it under social engineering, and PhishDestroy has already added the domain to its blocklist. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one additional security blocklist. The observed indicators collectively point to a brand‑impersonation campaign targeting the brand x.com.

Because the site is offline, direct observation of phishing content is not possible, leaving the exact delivery mechanism and payload unknown. However, the combination of registrar information, Cloudflare hosting, lack of SSL, and multiple vendor detections supports a high‑risk classification. Defenders should continue to block the domain at network perimeter, update URL filtering policies, monitor for any re‑use of the underlying IP address, and consider sharing IOCs with threat‑intel communities. Ongoing observations should focus on any re‑activation of the domain or related sub‑domains that may attempt to resume the impersonation campaign.