PhishingFirst seen March 30, 2026
Fake AT&T page
https://pub-0a634125d0bc49c4b256782bbc553fae.r2.dev/AT%26T%20SERVICE%20UPDATE%20(7).html
Why we flagged it
- The login page is hosted on Cloudflare's R2 object storage (r2.dev) rather than an official AT&T domain, which is a common indicator of a phishing site.
- The URL path contains a suspicious filename 'AT&T SERVICE UPDATE (7).html', suggesting it is a static malicious file designed to harvest credentials.
If you entered a password or card details on this page, change that password now and contact your bank or card issuer.
See what the page looked like
A free account unlocks the screenshot we captured and lets you dispute a verdict.
Sign in