att-internet[.]serviceroute[.]site

Analysis as of July 22 2026 flags att-internet.serviceroute.site as high‑risk generic phishing infrastructure. The domain was registered only nine days earlier on July 13 2026 through the registrar Spaceship, Inc., and is currently pointing to the IPv4 address 188.114.97.3. DNS resolution is served by Cloudflare’s authoritative nameservers grant.ns.cloudflare.com and kami.ns.cloudflare.com, indicating the use of a widely adopted CDN for fast resolution and potential abuse of Cloudflare’s edge network. Independent blocklist feeds have already added the domain to two reputable phishing blocklists; PhishDestroy and OpenPhish explicitly list it as malicious, and broader community blocklists also contain it.

VirusTotal scans show nine of ninety‑five antivirus or URL‑reputation engines flag the domain, reinforcing the suspicion raised by the blocklists. No public SSL certificate details, HTTP status codes, or page‑title metadata have been published, so the surface‑web content cannot be correlated at this time. Likewise, no sightings on OTX, Safe Browsing, or other reputation aggregators have been recorded.

The limited age of the domain combined with immediate detection suggests a quickly deployed campaign, likely leveraging the short registration window to evade long‑term reputation building. Defenders should block traffic to 188.114.97.3 and to the domain itself at perimeter firewalls and DNS filters, update intrusion‑prevention signatures with the observed blocklist identifiers, and monitor for any future resolution changes or additional hostnames using the same Cloudflare nameservers. Continuous re‑scanning on VirusTotal and inclusion in internal threat‑intel feeds are recommended to capture any evolution of the malicious payload or hosting shifts.