6a2d930d1db5f3344b65a808--gleeful-mermaid-933ec5[.]netlify[.]app

This domain is actively impersonating an AT&T sign-in portal to harvest user credentials. Analysis of the page title, 'Sign in - AT&T,' confirms the targeted brand, while infrastructure analysis reveals the domain is hosted on a content delivery platform with a German IP address (63.176.8.218) under Amazon.com, Inc. AS16509. The phishing page employs a valid SSL certificate issued by DigiCert Inc, which may lend an appearance of legitimacy to unsuspecting users.

Evidence from multiple security sources underscores the severity of this threat. The domain is flagged by 16 out of 95 security vendors on VirusTotal, with additional detections on one security blocklist. The registrar, Netlify, is a known vector for transient phishing campaigns due to its low-friction deployment capabilities. Google Safe Browsing has also classified this domain as phishing, further validating its malicious intent. No creation date is available, but the domain remains active as of this analysis.

Users who have visited this domain or entered credentials should immediately revoke any submitted information by resetting their AT&T account passwords. Multi-factor authentication (MFA) should be enabled to mitigate unauthorized access. System administrators are advised to block the domain and associated IP (63.176.8.218) at the network level. Monitoring for anomalous login attempts or unauthorized transactions is recommended for affected accounts.