att[.]wkqfe[.]cc

Analysis of the domain att.wkqfe.cc shows that it was registered on February 21, 2026 and resolves to the IP address 188.114.96.3, which is announced by Cloudflare under ASN 13335 and located in the United States. The host presents an SSL certificate identified as WE1, indicating the use of HTTPS despite the malicious intent. VirusTotal records indicate that 13 of 95 scanned security vendors have flagged the domain, confirming its association with malicious activity. The domain is also listed on a single security blocklist and has been actively blocked by the PhishDestroy service, providing additional evidence of its reuse in phishing operations.

Current network probes find the domain taken offline, so no live web content can be retrieved for deeper content analysis. Because the site is not reachable, details such as page title, brand targeting, or specific phishing kit cannot be confirmed at this time. Defenders should continue to enforce blocking of the domain and its associated IP address in perimeter firewalls and DNS filtering solutions. Monitoring for re‑registration or the appearance of similar sub‑domains that resolve to the same Cloudflare IP range is advisable, as threat actors often recycle infrastructure.

Adding the domain to internal threat‑intel feeds and correlating any future requests against the observed SSL fingerprint (WE1) can help detect resurrection attempts. In environments where the domain was previously contacted, incident responders should examine logs for credential exposure or session token leakage and consider resetting affected accounts. The combination of recent registration, multiple vendor detections, and active blocklist presence classifies the domain as an elevated‑risk phishing host, warranting proactive mitigation.