secure-page-builder--att-curent[.]replit[.]app

This domain is flagged as an active credential phishing threat targeting AT&T users. Infrastructure analysis reveals it is hosted on Replit, resolving to IP 34.117.33.233, with an SSL certificate issued by Google Trust Services. VirusTotal detection shows 15 of 95 security vendors flagging the domain, and Google Safe Browsing records a SOCIAL_ENGINEERING warning. The page title is 'Login Screen', which aligns with credential harvesting tactics. The domain remains active as of the report date, July 17, 2026. The exact content of the page has not been visually verified, so it is unclear whether the login screen fully replicates AT&T's branding or includes additional data capture mechanisms. Defenders should treat this domain as an active threat, block it at the network perimeter, and monitor for any credentials submitted to it. Users who may have accessed the domain should be alerted and advised to reset their AT&T account credentials immediately. Further analysis of the domain's source code and any redirect chains is recommended to identify additional infrastructure or victim targeting patterns.