att[.]drujs[.]cc

Analysis of att.drujs.cc indicates that the domain is currently offline but was actively used for a brand‑impersonation campaign targeting x.com. The domain was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to the Cloudflare‑owned address 172.67.177.109, ASN 13335, located in the United States. Both authoritative name servers, dell.ns.cloudflare.com and julian.ns.cloudflare.com, are Cloudflare services, confirming that the infrastructure is hosted behind a CDN. No TLS certificate is presented; HTTP responses return the generic “Welcome to nginx!” page title, suggesting the server is a default Nginx installation rather than a tailored phishing page.

Google Safe Browsing classifies the URL as social engineering, and PhishDestroy has added the domain to its blocklist. In addition, the domain appears on a single external security blocklist and received a Gridinsoft trust score of 0 / 100, indicating extreme malicious confidence. VirusTotal analysis shows that 14 of 93 scanned security vendors flagged the domain, reinforcing the malicious assessment. The combination of brand‑impersonation intent, Cloudflare hosting, lack of encryption, and multiple independent detections positions att.drujs.cc as a high‑risk indicator.

Defenders should immediately block the domain at perimeter filters, update URL reputation lists, and monitor for any future re‑registration attempts. Continuous observation of related Cloudflare IP ranges and the registrar Gname.com may help detect resurgence. Because the site is offline, content‑level examination is not possible; however, the existing telemetry is sufficient to justify preventive controls and threat‑intel sharing with peers.