att[.]jonkmf[.]cc

att.jonkmf.cc is a subdomain of jonkmf.cc. PhishDestroy first recorded this hostname on Jan 22, 2026. The assembled evidence scores 100/100 (critical).

One independent source is positive: VirusTotal. VirusTotal recorded 20 detections among 93 engines: ADMINUSLabs, Criminal IP, Bfore.Ai PreCrime, BitDefender, Cluster25, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Lionic, MalwareURL, Seclookup, SOCRadar, Sophos, Trustwave, VIPRE, Webroot on Feb 25, 2026 at 00:02 UTC. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. URLQuery recorded no positive detection. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0) on Mar 25, 2026 at 12:25 UTC. PhishStats returned no feed match on Mar 1, 2026 at 07:08 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:10 UTC; content was unavailable. Registration records for the registrable domain jonkmf.cc list Dynadot LLC as the registrar. At collection time, the hostname resolved to 188.114.96.3 on AS13335 (CLOUDFLARENET - Cloudflare, Inc., US). The associated network metadata labels the endpoint as AS13335 Cloudflare, Inc. in San Francisco, US. The stored server header is cloudflare. Captured page title: “Welcome to nginx!”. DOM analysis completed on Apr 23, 2026 at 03:21 UTC; stored DOM score 10/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Aug 2, 2026 at 04:16 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. The stored record does not establish the post-click interaction, and it does not claim a confirmed wallet-draining transaction or credential submission.