att-bonus[.]com[.]mx

This report analyzes the domain att-bonus.com.mx, a fraudulent site designed to impersonate the AT&T brand. Based on the page title "AT&T | Bonus" and the scam type classified as telecom, the site poses a significant threat by attempting to deceive users into believing they are accessing a legitimate AT&T bonus or reward program. The primary risk is the potential for credential theft or financial fraud, as victims may be tricked into providing sensitive personal information under the guise of a promotional offer.

Technical evidence confirms the malicious nature of this domain. VirusTotal reports 21 detections out of 95 security vendors, indicating widespread recognition as a threat. The domain was created on 2024-11-08 and is registered through GoDaddy.com, LLC. It resolves to IP address 185.127.160.192, hosted by AS203119 Servicios Tecnologicos TIM SL in Portugal. The SSL certificate is issued by GoDaddy Secure Certificate Authority - G2. The site is flagged by multiple security entities including ADMINUSLabs, Criminal IP, alphaMountain.ai, BitDefender, and Cluster25, and appears on 2 blocklists.

The domain is currently down or offline. Despite its inactive status, the risk level remains high due to the strong indicators of malicious intent. Trust scores are critically low, with GridinSoft rating it 0 out of 100 and ScamAdviser rating it 1 out of 100. This domain should be permanently blocked and monitored for potential reactivation or re-registration under similar names.