att[.]ncles[.]cc

The domain att.ncles.cc is a confirmed phishing site engaged in brand impersonation targeting x.com. It presents itself as the legitimate social media platform to deceive users into entering credentials or other sensitive information. No crypto drainer kit was detected, but the site was actively used for credential theft before being taken offline. Users searching whether att.ncles.cc is safe or a scam should treat it as malicious.

Technical analysis shows att.ncles.cc was flagged by 13 of 95 VirusTotal security vendors, including Criminal IP, Cluster25, and CRDF. The domain was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolved to IP address 172.67.147.7, hosted on Cloudflare’s network in the US. It appeared on one security blocklist (PhishDestroy) and had no SSL certificate, with the observed page title reading 'Welcome to nginx!'. The domain used Cloudflare nameservers (cash.ns.cloudflare.com and nancy.ns.cloudflare.com) and received a Gridinsoft trust score of 0/100.

Users who interacted with att.ncles.cc should immediately change passwords for any accounts accessed through the site, enable two-factor authentication, and monitor for unauthorized activity. Report the domain to Google Safe Browsing, the impersonated brand’s security team, and local cybercrime authorities. If financial or crypto accounts were exposed, revoke token approvals and consider transferring funds to a new wallet. Sharing details with threat-intelligence platforms helps prevent further abuse.