att[.]vnijsabg[.]cc

The domain att.vnijsabg.cc is identified as a generic_phishing site. There is no specific brand being impersonated, and no drainer kit has been detected. The site is currently active and poses an elevated risk to users.

Infrastructure analysis reveals that the domain att.vnijsabg.cc has been flagged by 18 out of 95 security vendors on VirusTotal, indicating a moderate level of suspicion. The domain is registered through Gname.com Pte. Ltd. and resolves to the IP address 172.67.149.149, which is located in the United States and is associated with AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services / WE1, providing a false sense of security. The domain was created on February 21, 2026, and appears on 1 security blocklist, including PhishDestroy.

The current status of the domain is active, and it remains a threat. Users and organizations should implement response actions such as blocking the domain at the network level and educating employees about the risks of phishing sites. The remaining risk is significant due to the domain's recent creation and the potential for it to be used in targeted phishing campaigns. Continuous monitoring and updating of security measures are recommended to mitigate the threat.