b82cd36b-0655-4db7-831c-ecc9395c47fc-00-22erhkkddlebh[.]worf[.]replit[.]dev

This domain represents a high-risk brand impersonation campaign targeting AT&T customers through a fraudulent verification portal. The page, titled 'AT&T Verification Portal,' mimics legitimate authentication workflows to harvest credentials, payment details, or personal information from unsuspecting users. Analysis indicates the domain was designed to exploit trust in the AT&T brand, likely distributing phishing kits or redirecting victims to malicious payloads under the guise of account verification or security updates. The threat actor appears to have leveraged the portal to induce urgency, a common tactic in credential theft operations targeting telecommunications subscribers.

Infrastructure analysis reveals the domain was registered through Replit Inc. and resolved to the IP address 34.75.151.117, hosted on Google LLC infrastructure (AS396982). At the time of assessment, the domain was flagged by 13 out of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious classification. Additionally, the domain appeared on two security blocklists (PhishDestroy and PhishingDB) and was marked as phishing by Google Safe Browsing. The SSL certificate, issued by Let's Encrypt (R13), provided a false sense of security while facilitating the impersonation attempt. No creation date was provided, but the domain has since been taken offline, suggesting mitigation efforts or evasion tactics by the threat actor.

Users who visited this domain or interacted with the 'AT&T Verification Portal' should immediately revoke any entered credentials, particularly for AT&T accounts, financial services, or email platforms. Multi-factor authentication (MFA) tokens or one-time passwords submitted through the portal should be considered compromised and reset. Affected individuals are advised to monitor accounts for unauthorized transactions, enable additional authentication layers, and scan devices for malware if executable files or scripts were downloaded. Organizations should update blocklists to include the domain and associated IP (34.75.151.117) to prevent further exposure. Reporting the incident to the targeted brand (AT&T) and relevant cybersecurity authorities can aid in broader mitigation efforts.