att-currently101[.]square[.]site

This domain, att-currently101.square.site, is identified as a brand impersonation phishing infrastructure targeting AT&T customers. Analysis indicates the site operated under the guise of a 'Free Shop,' a common tactic to lure victims into submitting sensitive credentials or payment details. The domain was designed to mimic legitimate AT&T services, increasing the likelihood of successful social engineering attacks against unsuspecting users. Infrastructure analysis reveals the domain was registered on February 05, 2019, through MarkMonitor, Inc., and resolved to the IP address 74.115.51.5, hosted on AS27647 (Weebly, Inc.). The SSL certificate was issued by Let's Encrypt (serial number E7), a detail often exploited by threat actors to lend false legitimacy. At the time of assessment, the domain was flagged by 19 out of 95 security vendors on VirusTotal and appeared on one security blocklist. The page title, 'Home | Free Shop,' further corroborates its fraudulent intent, as it deviates from AT&T’s official branding and service terminology. The domain has since been taken offline, likely following detection and reporting by security systems. However, residual risk remains due to the potential for re-registration or migration of the phishing infrastructure to alternative domains. Organizations are advised to monitor for similar impersonation attempts, particularly those leveraging subdomains of legitimate platforms (e.g., square.site) to evade detection. Network defenders should update blocklists to include this domain and its associated IP address, while users should be educated on recognizing brand impersonation tactics, such as unsolicited 'free' offers or non-standard page titles.