sentilogs[.]org

This domain, sentilogs.org, was identified as a high-risk phishing infrastructure specifically designed to impersonate AT&T, a major telecommunications provider. The site displayed a deceptive page titled 'AT&T Underconstruction,' a tactic commonly used to mimic legitimate maintenance pages while harvesting user credentials or sensitive account information. Given the domain's historical activity and association with known phishing campaigns, it likely targeted AT&T customers by redirecting them to fraudulent login portals or distributing malicious payloads under the guise of account verification or service updates. Analysis of the domain's infrastructure reveals multiple indicators of malicious intent. The domain was registered on March 01, 2021, through Tucows Domains Inc., a registrar frequently observed in phishing operations due to its accessibility and bulk registration capabilities. It resolved to the IP address 216.55.149.9, hosted under AS30447 (Internet Names For Business Inc.), an autonomous system with a history of hosting suspicious domains. Detection metrics further substantiate the threat: VirusTotal reports 17 out of 95 security vendors flagged sentilogs.org as malicious, while it appears on two security blocklists, including PhishDestroy and PhishingDB. Additionally, Google Safe Browsing classified the domain as phishing, reinforcing its fraudulent nature. Users who accessed sentilogs.org should take immediate remedial action to mitigate potential compromise. If credentials or personal information were entered on the site, affected individuals must change passwords for all associated accounts, prioritizing those linked to financial or email services. Enable multi-factor authentication where available to add an additional layer of security. Monitor account statements and credit reports for unauthorized activity, as phishing campaigns often precede identity theft or financial fraud. System scans using updated security tools are recommended to detect any residual malware or backdoors. Given the domain's offline status, users should remain vigilant for similar phishing attempts, particularly those leveraging telecommunications branding or urgent account notifications.