attmailing4064selfservices345pporoble[.]weebly[.]com

This domain, attmailing4064selfservices345pporoble.weebly.com, is actively engaged in brand impersonation targeting AT&T customers through a fake login portal. Analysis indicates the site is designed to harvest credentials by mimicking legitimate self-service portals, a tactic consistent with credential theft campaigns. The domain remains operational as of the latest assessment, with no takedown or mitigation measures observed. Infrastructure analysis reveals the domain was registered through Squarespace Domains II LLC on February 21, 2026, an unusually future-dated creation that may indicate domain spoofing or registry manipulation. It resolves to the IP address 74.115.51.8 and is protected by Cloudflare, a common evasion technique to obscure hosting origins. The SSL certificate is issued by Let’s Encrypt, providing a veneer of legitimacy while the page title, 'Just a moment...', suggests the use of anti-bot or cloaking mechanisms. Security vendors have flagged this domain as malicious, with 13 of 95 VirusTotal engines detecting it as phishing infrastructure. Additionally, the domain appears on one security blocklist, though broader adoption remains limited. The current status of this domain is active, with no signs of remediation or disruption. Users encountering this site are advised to avoid interaction, particularly entering credentials or personal information. Network administrators should block the domain and its associated IP (74.115.51.8) at the perimeter. Organizations should monitor for credential reuse attempts stemming from this campaign, as harvested data is likely to be exploited for account takeovers or follow-on attacks. Given the use of Cloudflare and the future-dated registration, further investigation into the hosting provider and registrar is warranted to assess potential abuse patterns.