att[.]kexia[.]icu

This domain, att.kexia.icu, is flagged as a generic phishing site designed to impersonate AT&T’s official login portal. Analysis indicates the threat actor deployed a credential-harvesting page to capture user account details, likely targeting customers of the telecommunications provider. No specific drainer kit signatures have been identified, but the infrastructure aligns with common phishing-as-a-service (PhaaS) frameworks used for large-scale credential theft campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through an undisclosed registrar. It resolves to IP address 172.67.153.130, hosted on Cloudflare’s network (AS13335), a common tactic to obscure origin servers. VirusTotal detection shows 19 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and was not listed in Google Safe Browsing at the time of analysis. The SSL certificate is issued by WE1, a low-assurance provider frequently used in phishing operations. As of the latest assessment, att.kexia.icu has been taken offline, likely following abuse reports or automated takedown procedures. The domain was blocked by at least one security provider, and Cloudflare’s infrastructure may have suspended the associated hosting. Despite its offline status, residual risk remains for users who may have interacted with the site prior to takedown. Organizations are advised to monitor for credential reuse attempts and implement multi-factor authentication (MFA) to mitigate account compromise. Network defenders should update blocklists to include the domain and its resolving IP to prevent future access attempts.