attlink[.]keepo[.]bio

This domain, attlink.keepo.bio, is flagged as a generic phishing site targeting AT&T customers. Analysis indicates it mimics legitimate AT&T login portals to harvest user credentials, likely deploying a credential drainer kit to capture sensitive account information. The page title explicitly displays 'ATT,' reinforcing its impersonation of the telecommunications provider's branding. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameCheap, Inc. It resolves to the IPv6 address 2606:4700:3035::ac43:bce0 and is associated with an SSL certificate issued by Google Trust Services (WE1). VirusTotal reports 20 out of 95 security vendors detecting the domain as malicious, while it appears on one security blocklist. No Google Safe Browsing (GSB) hits are currently recorded, but the elevated detection rate suggests active malicious intent. The domain remains active and poses an ongoing risk to users. Response actions should include immediate blocking of the domain and associated IP at network perimeters, along with user education to recognize phishing indicators. Despite its presence on a single blocklist, the 21% detection rate on VirusTotal and recent registration date indicate a persistent threat. Organizations are advised to monitor for related infrastructure and enforce multi-factor authentication to mitigate credential theft risks.