advantagefinance[.]net

This domain, advantagefinance.net, is confirmed to host an AT&T-themed phishing campaign targeting telecommunications credentials. Analysis of the page title, 'AT&T Underconstruction,' indicates an attempt to mimic legitimate AT&T infrastructure, likely to deceive users into submitting sensitive login or financial details. No specific drainer kit signatures were identified, but the generic phishing classification suggests broad targeting of user credentials under the guise of a trusted brand. Infrastructure analysis reveals the domain was registered through Hostopia Canada Corp and resolves to the IP address 216.55.149.9, hosted on AS30447 (Internet Names For Business Inc.) in the United States. The domain was created on November 02, 2004, though its malicious use appears to be recent. Google Safe Browsing explicitly flags it as phishing, and VirusTotal reports 15 out of 95 security vendors detecting it as malicious. The domain appears on two security blocklists, and its SSL certificate, issued by Sectigo Limited (Sectigo Public Server Authentication CA DV R36), does not mitigate the underlying threat. As of the latest assessment, advantagefinance.net has been taken offline, likely in response to security vendor detections and blocklist inclusions. However, the domain's long-standing registration and prior hosting on reputable infrastructure pose residual risks. Organizations and users are advised to monitor for similar AT&T-themed phishing domains, particularly those leveraging aged domains or Sectigo-issued certificates. Proactive blocking of the IP 216.55.149.9 and domains registered via Hostopia Canada Corp may reduce exposure to related campaigns.