att-109117-101989[.]weeblysite[.]com

PhishDestroy identifies att-109117-101989.weeblysite.com as a high-risk credential theft page masquerading as AT&T’s official login portal. The domain hosts a counterfeit login screen designed to harvest user credentials, leveraging the trusted AT&T brand to deceive victims into entering sensitive information. Analysis reveals no evidence of advanced drainer kit integration; instead, the threat relies on classic social engineering tactics to trick users into submitting their login details directly to attacker-controlled infrastructure.

This domain was flagged by 12 out of 95 VirusTotal security vendors, indicating a moderate but notable detection rate. It was registered through MarkMonitor, Inc., a legitimate registrar often abused for impersonation campaigns. The domain resolves to IP 74.115.51.55 and operates under a Google Trust Services SSL certificate, which may lend false credibility to the phishing page. Notably, the domain was created on December 19, 2012, suggesting a long-standing but still active abuse case. The page title, “Login Screen | AT&T,” further reinforces the impersonation effort.

As of the latest assessment, att-109117-101989.weeblysite.com remains active and poses an ongoing risk to users attempting to access AT&T services. Immediate actions include adding the domain and IP to blocklists, flagging the SSL certificate, and notifying AT&T’s abuse team for takedown. Organizations should also deploy user awareness training to highlight the risks of credential input on non-official domains. While the current risk is high due to active hosting and impersonation tactics, coordinated response efforts can mitigate further exploitation.