keepersofthelightbook[.]com

This domain, keepersofthelightbook.com, poses as an AT&T login portal but is a credential-harvesting phishing site. Visitors are presented with a page titled 'AT&T Underconstruction,' designed to mimic the legitimate telecommunications provider. The site collects entered usernames and passwords, which are then transmitted to threat actors for account takeover, financial fraud, or further targeted attacks. No legitimate service or corporate entity operates through this domain, and its sole purpose is to deceive users into disclosing sensitive login credentials. Analysis indicates the domain was registered on April 04, 2021, through Tucows Domains Inc. and currently resolves to the IP address 216.55.149.9, hosted on AS30447 (Internet Names For Business Inc.). The domain lacks an SSL certificate, increasing exposure to man-in-the-middle interception. VirusTotal reports 19 out of 95 security vendors flagging the domain as malicious, and it appears on two independent security blocklists. Google Safe Browsing has also classified the site as phishing. The combination of brand impersonation, absence of encryption, and multiple detection flags confirms the domain’s fraudulent intent. If you visited keepersofthelightbook.com and entered login credentials, immediately change your AT&T account password using a trusted device. Enable multi-factor authentication if not already active. Monitor your account for unauthorized transactions or configuration changes. Do not reuse the exposed password on any other service. Consider scanning your device for malware, as phishing sites may redirect to exploit kits or prompt downloads of malicious payloads. Report the incident to your organization’s security team or the appropriate fraud response unit for further mitigation.