ubiquitous-gingersnap-809853[.]netlify[.]app

This domain is flagged as a high-risk brand impersonation phishing site designed to harvest user credentials by mimicking the AT&T Mail and Currently.com login interface. Analysis indicates the page title explicitly states 'Sign in to access AT&T Mail and Currently.com,' a clear attempt to deceive users into entering sensitive account information under false pretenses. The threat type aligns with credential theft campaigns targeting telecommunications customers, a common vector for account takeover and subsequent fraudulent activity. Infrastructure analysis reveals the domain ubiquitous-gingersnap-809853.netlify.app is hosted on Netlify’s platform, resolving to the IP address 98.84.224.111. Security vendors on VirusTotal have flagged this domain, with 15 out of 95 engines detecting malicious activity. The SSL certificate is issued by DigiCert Inc under the 'DigiCert Global G2 TLS RSA SHA256 2020 CA1' authority, a legitimate provider often exploited by threat actors to lend false credibility. Google Safe Browsing has classified this domain as phishing, and it appears on at least one security blocklist, further corroborating its malicious nature. No legitimate creation date or registration details are publicly available, as the domain leverages Netlify’s subdomain infrastructure, which does not require traditional WHOIS disclosure. Users encountering this domain should immediately cease interaction and avoid entering any credentials. Given the high-risk nature of brand impersonation, affected individuals are advised to reset passwords for any accounts accessed via the fraudulent page, particularly AT&T or other telecommunications services. Organizations should block the domain and IP address 98.84.224.111 at the network perimeter to prevent further exposure. Security teams are recommended to monitor for signs of credential compromise, such as unusual login attempts or unauthorized account activity, and implement multi-factor authentication as an additional safeguard against credential theft.