bluffsidemedia[.]com

This domain, bluffsidemedia.com, is identified as an active credential phishing site impersonating AT&T, a major telecommunications provider. Analysis of the page title and infrastructure confirms its targeting of AT&T customers, likely aiming to harvest login credentials, payment details, or personal information through deceptive landing pages. The site employs no overt drainer kit signatures but relies on social engineering tactics typical of large-scale phishing campaigns. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 17, 2017, through Tucows Domains Inc. and currently resolves to the IP address 198.49.23.144, hosted under AS53831 (Squarespace, Inc.). Detection metrics indicate a VirusTotal score of 17/95 security vendors flagging the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, though it is not currently listed in Google Safe Browsing. The SSL certificate is issued by Let's Encrypt (R13), providing a veneer of legitimacy to unsuspecting users. As of the latest assessment, bluffsidemedia.com remains active and poses a high risk to users. While partial blocking has been implemented by select security providers, the domain continues to resolve and may evade detection in environments lacking updated threat intelligence. Users are advised to avoid interacting with the domain, and network administrators should implement DNS-level blocking or web filtering rules to mitigate exposure. Organizations should monitor for credential theft attempts originating from this infrastructure and educate users on recognizing phishing indicators, such as mismatched URLs and unsolicited authentication requests.