6a2d92a9d242d7b5e453154c--sweet-tarsier-be1a2a[.]netlify[.]app

This domain operates as a high-risk credential theft site impersonating AT&T, designed to harvest user login credentials. The fraudulent page displays a convincing replica of the legitimate AT&T sign-in portal, complete with corporate branding and input fields for usernames and passwords. Victims who enter their credentials risk unauthorized account access, financial fraud, and identity theft, with potential secondary attacks targeting linked services or devices. Analysis indicates the domain is hosted on Netlify infrastructure and resolves to IP address 63.176.8.218. The site remains active despite detection by 17 out of 95 security vendors on VirusTotal, including a Google Safe Browsing phishing flag. The SSL certificate, issued by DigiCert Inc, provides a false sense of security while the page title explicitly mimics AT&T's official portal. Only one security blocklist currently lists this domain, suggesting recent deployment or evasion tactics. Users who visited this domain should immediately change their AT&T account password and enable multi-factor authentication. Review recent account activity for unauthorized logins or transactions, and monitor linked email accounts for suspicious password reset attempts. If financial information was entered, contact the relevant institution to flag potential fraud. Security teams should block the domain and IP address across all network defenses, and report the incident to relevant fraud prevention authorities for further investigation.