att[.]yfhoi[.]cc

This domain, att.yfhoi.cc, has been identified as a credential harvesting phishing site specifically designed to impersonate AT&T login portals. Analysis indicates the infrastructure was crafted to deceive users into submitting sensitive account credentials, including usernames, passwords, and potentially multi-factor authentication codes. The phishing kit appears to employ dynamic content loading to mimic legitimate AT&T authentication flows, increasing the likelihood of successful deception. Given the domain's focus on telecommunications credentials, compromised accounts could enable unauthorized access to billing information, call logs, or even SIM-swap attacks, amplifying the potential impact on victims. Technical evidence confirms the elevated risk posed by this domain. As of the latest assessment, 16 out of 95 security vendors on VirusTotal have flagged att.yfhoi.cc as malicious, with detection labels including 'phishing' and 'credential_theft.' The domain was registered on February 21, 2026, through an undisclosed registrar, and resolves to the IP address 172.67.143.168, which is associated with Cloudflare, Inc. (AS13335) in the United States. The domain appears on one security blocklist, and its SSL certificate (WE1) lacks extended validation, a common characteristic of low-effort phishing operations. Infrastructure analysis reveals the use of Cloudflare's content delivery network, which may have been leveraged to obfuscate the true origin of the phishing server and evade initial detection. Users who visited att.yfhoi.cc or entered credentials on any page hosted under this domain should assume their account information has been compromised. Immediate action is required, including resetting passwords for AT&T accounts and any other services where identical credentials may have been reused. Affected individuals should enable multi-factor authentication on all critical accounts and monitor for unauthorized activity, such as unexpected login attempts or changes to account settings. If financial or personal data was entered, users are advised to review bank statements and credit reports for signs of fraudulent activity. Organizations should update their email and web filtering rules to block this domain and its associated IP address (172.67.143.168) to prevent further exposure. Given the domain's current offline status, users should remain vigilant for similar phishing attempts, as threat actors often rotate domains to sustain their campaigns.