bellsouth-att-sign-in-5c7603[.]webflow[.]io

The domain bellsouth-att-sign-in-5c7603.webflow.io, which impersonates AT&T, has been flagged by 17 out of 95 vendors on VirusTotal, indicating a significant recognition of its malicious intent. The site has been taken down and is currently offline, but it was previously hosted by Cloudflare, Inc. in the US. Google Safe Browsing has also flagged this domain, further confirming its threat level.

Registered through NameCheap, Inc., this phishing domain targeted AT&T customers by mimicking a legitimate sign-in page. The domain was created on February 21, 2026, and was detected by PhishDestroy on the same day, demonstrating the rapid identification capabilities of our threat intelligence pipeline. The page's title, "bellsouth att sign in," was designed to deceive users into entering their credentials, potentially leading to unauthorized access to their accounts.

While the domain is now offline, its initial setup highlights the ongoing threat of telecom-related phishing attacks. The use of a legitimate SSL certificate from Google Trust Services might have lent an appearance of authenticity, potentially tricking users into believing the site was secure. The swift action to take the site down and its inclusion in public blocklists, including PhishDestroy's, underscores the importance of early detection and response in mitigating such threats. Despite its current status, the domain's brief activity period serves as a reminder of the persistent and evolving nature of phishing campaigns.