att[.]pgjas[.]cc

Analysis of the domain att.pgjas.cc indicates a phishing campaign targeting users through a fraudulent login portal. The domain was registered on February 21, 2026, and resolved to the IP address 172.67.142.138, hosted on Cloudflare's infrastructure (AS13335) in the United States. As of July 23, 2026, the domain has been taken offline, though it remains flagged by 16 of 93 security vendors on VirusTotal and appears on at least one security blocklist, including PhishDestroy. The SSL certificate associated with this domain is identified as WE1, a common certificate type that does not inherently indicate malicious activity but is frequently observed in phishing infrastructure due to its low-cost or free availability.

No specific brand target or phishing kit is confirmed in the available data, though the domain name suggests an attempt to impersonate AT&T services. The exact content of the phishing page is not yet analyzed, and no additional details regarding the scam type (e.g., credential harvesting, payment fraud) are available at this time. Defenders should treat this domain as a confirmed phishing threat based on its detection history and blocklist status. Network-level blocking of the IP 172.67.142.138 and domain att.pgjas.cc is recommended for organizations, particularly those in sectors likely to be targeted by telecommunications-related phishing.

Given the domain's use of Cloudflare, defenders may also monitor for related domains leveraging the same IP or registrar, as phishing campaigns often reuse infrastructure. If internal logs indicate user interaction with this domain, immediate credential resets and device scans are advised, as the site may have harvested login details or deployed malware. Further analysis of historical DNS records and SSL certificates may reveal additional linked infrastructure for takedown efforts.