Phishing detection: click.account.att-mail.com

AT&T
https://click.account.att-mail.com/redirect_error.html Access site
Screenshot
No screenshot available yet Captured automatically on the next refresh cycle
Investigate
Domain click.account.att-mail.com79 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 13.111.180.170
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://click.account.att-mail.com/redirect_error.html
urlscan Wayback archive.today
Cert DigiCert Global G2 TLS RSA SHA256 2020 CA1
crt.sh Censys Google CT
Phishunt analysis Beta
14 noiseheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +3.0 OpenPhish
  • +1.1 ASN reputation
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.7 Unrecognised DNS provider
  • +0.6 Brand impersonation in path
  • +0.5 Long domain
  • +0.3 Deep subdomain
  • +0.2 Suspicious TLD
  • +0.1 Hyphens
11 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Site uses a subdomain of att-mail.com to impersonate AT&T, serving a redirect error page likely used as a step in a credential harvesting flow. Confirmed malicious by OpenPhish; infrastructure is Salesforce-hosted, suggesting abuse of email marketing or click-tracking services.

OpenPhishBrand impersonation in pathKeyword match
AI-generated from stored detector signals - the AI never visited the site. · 2026-09-16 · confidence 55%
Domain & Network
Whois
Registrar CSC Corporate Domains, Inc.
Network
IP 13.111.180.170
Country United StatesUnited States
Hosting Salesforce, Inc.
ASN AS14340
TLS Cert DigiCert Global G2 TLS RSA SHA256 2020 CA1
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Report this phishing
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-09-16 01:03 UTC  ·  Last refreshed 2026-09-16 01:03 UTC