Phishing sites impersonating AT&T

PhishDestroy has recorded 68 phishing domains impersonating AT&T since 2025-10-14, 0 of them in the last 30 days. The most used registrars are MarkMonitor and Safenames; the most common TLDs are .io and .com. Open AT&T only from its official app or a saved bookmark.

68
Domains, all time
0
Last 30 days
21
Online at last check
61
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 02026-08-02: 02026-08-03: 02026-08-04: 02026-08-05: 02026-08-06: 02026-08-07: 02026-08-08: 02026-08-09: 02026-08-10: 02026-08-11: 02026-08-12: 02026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 02026-08-24: 02026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 02026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 02026-09-06: 02026-09-07: 02026-09-08: 02026-09-09: 02026-09-10: 02026-09-11: 02026-09-12: 02026-09-13: 02026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 02026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 02026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 02026-10-08: 02026-10-09: 02026-10-10: 02026-10-11: 02026-10-12: 02026-10-13: 02026-10-14: 02026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 02026-10-20: 02026-10-21: 02026-10-22: 0
AT&T phishing domains detected per day: 0 from 2026-07-25 to 2026-10-22; peak 1.

How to tell a fake AT&T site

Words most often added to the brand in reported domains: bellsouth, sign, weeblysite, signing, redirection, unique, attt, ailworkinsite, attonlinesit, broadatt.

  • Type the address yourself or use a bookmark; phishing links for AT&T arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • AT&T does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest AT&T phishing domains

The 50 most recently detected domains impersonating AT&T
DomainFirst detectedStatus at last checkRegistrar
bellsouth-att-sign-in-4f949a.webflow.io2026-02-25OfflineMarkMonitor
regular-patterns-355532.framer.app2026-02-25OfflineCSC Corporate Domains
bellsouth-att-sign-in-5c7603.webflow.io2026-02-21OfflineNameCheap
at-t-d7e7ee.webflow.io2026-02-19OfflineNameCheap
sbc-d25516.webflow.io2026-02-16OfflineNameCheap
2025-att-confirm-email.weeblysite.com2026-02-15Taken downSafeNames
a72fcb49-d28a-4223-9338-f24d8ccf01b9-00-rzey68jeql2m.kirk.replit.dev2026-02-07Taken downNameCheap
atttttt108068.weeblysite.com2026-02-03Taken downSafeNames
attnet-108557.weeblysite.com2026-02-03Taken downSafeNames
attinfo-107427-102340.weeblysite.com2026-02-03Taken downSafeNames
attmailupdate-105825.weeblysite.com2026-02-03Taken downSafeNames
attofficeadmin.weebly.com2026-01-31Taken downSquarespace Domains II
att-currently101.square.site2026-01-22Taken downMarkMonitor
att-login-4198.weeblysite.com2026-01-18Taken downSafeNames
ambitious-objects-055440.framer.app2026-01-02Taken downCSC Corporate Domains
neveergiveup.weebly.com2026-01-02Taken downSafenames
bellsouth-att-sign-in-ccb981.webflow.io2026-01-02Taken downMarkMonitor
bellsouth-att-sign-in-339ec8.webflow.io2025-12-29Taken downMarkMonitor
bellsouth-att-sign-in-033b77.webflow.io2025-12-28Taken downMarkMonitor
pelumipeller.weebly.com2025-12-28Taken downSafenames
bellsouth-att-sign-in-a4f187.webflow.io2025-12-26Taken downWebflow
att021.weebly.com2025-12-22Taken downSafenames
attmailboxcheck1111.weebly.com2025-12-22Taken downSafenames
bellsouth-att-validation-sign-in-site.webflow.io2025-12-20Taken downMarkMonitor
bellsouth-att-sign-in-4e0e0b.webflow.io2025-12-18Taken downMarkMonitor
bellsouth-att-sign-in-c769af.webflow.io2025-12-18Taken downMarkMonitor
bellsouth-att-sign-in-423dfb.webflow.io2025-12-18Taken downMarkMonitor
bellsouth-att-signing-a46195.webflow.io2025-12-18Taken downMarkMonitor
bellsouth-att-sign-in-87e71e.webflow.io2025-12-18Taken downMarkMonitor
bellsouth-att-sign-in-fdbdf1.webflow.io2025-12-14Taken downMarkMonitor
bellsouth-att-sign-in-02e55b.webflow.io2025-12-14Taken downMarkMonitor
bellsouth-att-sign-in-verification.webflow.io2025-12-13Taken downMarkMonitor
bellsouth-att-sign-in-4b8c33.webflow.io2025-12-13Taken downMarkMonitor
bellsouth-att-sign-in-f487e4.webflow.io2025-12-09Taken downMarkMonitor
bellsouth-att-sign-in-abe8d5.webflow.io2025-12-09Taken downMarkMonitor
attyahoomail-servicescomms.weeblysite.com2025-12-08Taken downSafenames
att-bonus.com.mx2025-12-07OnlineGoDaddy.com
att-103446-103201.weeblysite.com2025-12-06Taken downSafenames
oeze5y57b26xn8zk.umso.co2025-12-02Taken downName.com
currentlyattcommsyahoonet.weeblysite.com2025-11-26Taken downSafenames
524fb8att0w2curr3ntly82view9ir58ios2.netlify.app2025-11-26Taken downNetlify
bellsouth-att-signing-b613f6.webflow.io2025-11-26Taken downMarkMonitor
att-currrently-3435.weeblysite.com2025-11-23Taken downSafenames
attmessageattyahoomail.weeblysite.com2025-11-23Taken downSafenames
bellsouth-att-signing-c0218f.webflow.io2025-11-21Taken downMarkMonitor
home-8mhvx.wstd.io2025-11-21Taken downNameCheap
bellsouth-att-sign-in-9f0da3.webflow.io2025-11-20Taken downMarkMonitor
site-8bbeubmoo.godaddysites.com2025-11-19Taken downGoDaddy.com
b82cd36b-0655-4db7-831c-ecc9395c47fc-00-22erhkkddlebh.worf.replit.dev2025-11-18Taken downReplit
site-h1gzufxrm.godaddysites.com2025-11-15Taken downGoDaddy.com

All 68 AT&T reports

Where they are registered and hosted

Registrars

  1. MarkMonitor33
  2. Safenames9
  3. SafeNames6
  4. NameCheap5
  5. CSC Corporate Domains4
  6. GoDaddy.com3
  7. Safenames3
  8. Replit1

Top-level domains

  1. .io37
  2. .com21
  3. .app4
  4. .dev2
  5. .website1
  6. .co1
  7. .mx1
  8. .site1

Hosting networks

  1. CLOUDFLARENET, US33
  2. WEEBLY, US13
  3. WEEBLY - Weebly, Inc., US7
  4. AMAZON-02, US6
  5. CLOUDFLARENET - Cloudflare, Inc., US4
  6. GOOGLE-CLOUD-PLATFORM, US1
  7. AMAZON-AES, US1
  8. TIMWE Servicios Tecnologicos TIM SL, ES1

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is AT&T; share of all PhishDestroy reports: 0.03%.