91715[.]business-atice-pagetick8723[.]xyz

This domain, 91715.business-atice-pagetick8723.xyz, is identified as a generic phishing site designed to impersonate AT&T Business customer portals. Analysis indicates the infrastructure was likely configured to harvest corporate credentials, payment details, or other sensitive account information under the guise of a legitimate telecommunications service portal. The domain name embeds 'atice,' a partial homoglyph of 'AT&T,' combined with random numeric and alphanumeric strings to evade detection and mimic official subdomains. No specific drainer kit signatures have been confirmed, but the pattern aligns with credential phishing campaigns targeting enterprise users. Technical indicators confirm the domain was registered on December 06, 2025, through Atak Domain, a registrar frequently associated with low-cost, short-lived phishing domains. It resolves to the IPv6 address 2606:4700:3032::ac43:bc15, hosted behind Cloudflare (AS13335), which is commonly exploited to mask origin servers and bypass reputation-based filters. VirusTotal detection shows 10 out of 95 security vendors flagging the domain as malicious, while it appears on two independent security blocklists. The domain lacks an SSL certificate, a red flag for user trust and data integrity, and currently returns a 502 Bad Gateway error, suggesting backend takedown or misconfiguration. As of the latest scan, 91715.business-atice-pagetick8723.xyz is offline, likely following enforcement actions by hosting providers or domain registrars. However, residual risk remains due to potential DNS caching, cached phishing pages, or re-registration under a similar domain. Organizations are advised to block the domain and its resolved IP at the perimeter, monitor for internal access attempts, and alert employees to report any suspicious communications referencing AT&T Business portals. Proactive hunting for related domains using the 'atice' homoglyph or 'pagetick' substring is recommended to preempt follow-up campaigns.