bellsouth-att-sign-in-abe8d5[.]webflow[.]io

The domain bellsouth-att-sign-in-abe8d5.webflow.io was observed hosting a brand‑impersonation campaign targeting AT&T. Registration data shows the domain was created on May 08, 2013 and is managed by MarkMonitor, Inc., a registrar commonly used for legitimate trademark protection. Despite its legitimate registrar, the site achieved a Scamadviser trust score of 1 out of 100, indicating extreme untrustworthiness. Technical analysis reveals the domain resolves to IP address 172.64.151.8, which is owned by Cloudflare, Inc. (AS13335) and located in the United States. The domain is served through Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and the TLS certificate presented is issued by Google Trust Services under the WE1 designation, a standard Cloudflare‑provided certificate.

HTTP probing returned a 404 status code, and the page title returned by the server is "bellsouth att sign In," matching the brand‑impersonation theme. The site leveraged Cloudflare’s HTTP/3 protocol, confirming modern transport usage. Threat‑intelligence feeds show the domain appears on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal analysis recorded 16 detections out of 95 scanning engines, reinforcing its malicious nature.

The elevated risk rating is consistent with the observed indicators. As of the report date, July 24, 2026, the domain is reported offline, but historical evidence suggests it was previously used for phishing. Defensive recommendations include adding the domain and its associated IP address to network deny lists, monitoring for any re‑registration attempts, and ensuring that web‑filtering solutions reference the blocklist entry and VirusTotal detection count. Continuous vigilance is advised because the underlying Cloudflare infrastructure could be reused for future impersonation campaigns.