https://dev.att.axenda.io/

Impersonating AT&T

Intent: Data collection

• Domain is not operated by AT&T
• TLS certificate has no organization information
• TLS certificate was issued very recently
• SPF record does not reference AT&T's infrastructure

login form page for ATT LMS with email and password input fields