att[.]yorkss[.]com

This domain, att.yorkss.com, is flagged as a credential theft operation impersonating AT&T, a major telecommunications provider. Analysis indicates the site was designed to harvest user login credentials through a spoofed AT&T authentication portal, as evidenced by the page title 'AT' and the domain's structural mimicry of official AT&T branding. No cryptocurrency drainer kit signatures were detected, confirming the primary objective as credential exfiltration rather than wallet compromise. Infrastructure analysis reveals the domain was registered through DomainSpot LLC on July 29, 2009, though recent malicious activity suggests either a compromise of an older, dormant domain or a re-registration for fraudulent purposes. The domain resolves to the IP address 142.251.110.121, hosted on Google Cloud infrastructure, and employs an SSL certificate issued by Google Trust Services. Detection metrics show 17 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single security blocklist. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect a lag in propagation rather than a clean status. As of the latest assessment, att.yorkss.com has been taken offline, likely in response to security vendor interventions or hosting provider enforcement. However, the domain's age and registration history introduce residual risk, as threat actors may re-deploy it or repurpose similar infrastructure. Users who interacted with the site prior to its takedown are advised to rotate credentials immediately, particularly for AT&T accounts or any services where password reuse occurred. Organizations should monitor for related domains registered through DomainSpot LLC or resolving to the same IP range, as these may indicate follow-on campaigns leveraging the same operational patterns.