att[.]b2cdemostore[.]com

Analysis indicates that the domain att.b2cdemostore.com remains active as of the report date, August 05, 2026, and is classified as a high‑risk generic phishing site. The domain was registered on April 08, 2026 through GoDaddy.com, LLC and is hosted on the IP address 52.222.236.60, which is an Amazon Web Services (AWS) range. Its authoritative name servers are ns-1445.awsdns-52.org, ns-1588.awsdns-06.co.uk, ns-369.awsdns-46.com, and ns-837.awsdns, confirming the use of AWS DNS infrastructure. Threat intelligence feeds have listed the domain on two public blocklists, specifically PhishDestroy and OpenPhish, indicating that multiple security vendors have observed malicious activity associated with this host.

VirusTotal scans show that 12 of 91 security vendors flagged the domain, reinforcing the suspicion of malicious use. No publicly available data on SSL certificates, HTTP response codes, page titles, or additional threat‑intel platforms such as OTX were found, leaving those aspects of the infrastructure unconfirmed. Defenders should block any outbound or inbound traffic to 52.222.236.60 and add att.b2cdemostore.com to local and network‑level deny lists.

Continuous monitoring of the listed name servers and the AWS IP range is advised, as changes could indicate further campaign expansion. Organizations using email filtering or web proxy solutions should ensure that the domain is explicitly denied and that any messages containing URLs to this host are quarantined. Given the high risk rating and the presence on multiple blocklists, rapid containment and user awareness measures are recommended to mitigate potential credential harvesting or other phishing outcomes.