att[.]hmebq[.]cc

This domain, att.hmebq.cc, is flagged as a generic phishing resource designed to harvest user credentials through brand impersonation. Analysis indicates the domain mimics AT&T, a major telecommunications provider, to deceive victims into submitting sensitive login information. The infrastructure shows no direct evidence of a drainer kit, but the credential-harvesting mechanism aligns with common phishing toolkits deployed in targeted campaigns. Infrastructure analysis reveals the domain was registered on February 21, 2026, through an undisclosed registrar, resolving to the IP address 104.21.48.86, which is hosted on Cloudflare's network (AS13335). Detection metrics confirm elevated risk, with 20 out of 95 security vendors on VirusTotal flagging the domain as malicious. The domain appears on one security blocklist and is currently blocked by internal phishing detection systems. SSL certificate analysis identifies the use of a WE1 certificate, a common low-assurance certificate type exploited in phishing operations. As of the latest assessment, att.hmebq.cc has been taken offline, reducing immediate exposure risk. However, the domain's recent creation date and use of Cloudflare infrastructure suggest potential for rapid redeployment under a new subdomain or related domain. Users who may have interacted with the domain are advised to reset credentials on any associated accounts and monitor for unauthorized access. Organizations should update blocklists to include this domain and its resolved IP to prevent future exposure. Remaining risk is classified as elevated due to the domain's proven capability to evade initial detection and its association with a high-profile brand target.