att[.]mvusy[.]cc

The domain att.mvusy.cc has been identified as a confirmed fake login portal specifically designed to impersonate AT&T, a major telecommunications provider. This phishing site aims to harvest user credentials by presenting a fraudulent login interface that mimics the legitimate AT&T customer portal. As of the latest verification, the domain has been taken offline, though prior activity indicates a targeted campaign against AT&T subscribers. Analysis of att.mvusy.cc reveals multiple technical indicators of malicious intent. The domain was created on January 25, 2026, and is registered through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.), a network commonly used to obfuscate malicious infrastructure. The domain is flagged by 17 out of 95 security vendors on VirusTotal, with a detection consensus classifying it as a phishing threat. Additionally, it appears on one security blocklist, and its SSL certificate is categorized as WE1, a low-trust classification often linked to fraudulent sites. Infrastructure analysis further indicates that the domain leveraged Cloudflare’s CDN services, likely to evade geolocation-based blocking and complicate forensic tracking. Current status confirms that att.mvusy.cc is offline, reducing immediate exposure risk. However, the domain’s infrastructure and registration details suggest potential for reactivation or reuse in future campaigns. Organizations and individuals are advised to implement the following mitigations: block the domain and its resolving IP (188.114.97.3) at the network perimeter, monitor for credential reuse attempts from users who may have interacted with the site, and conduct retrospective log analysis to identify any prior access. Users should be educated on recognizing phishing attempts, particularly those impersonating telecommunications providers, and encouraged to verify domain authenticity before entering credentials. Given the elevated risk level, security teams should treat any prior interaction with this domain as a potential compromise and initiate password resets for affected accounts.