# Phishing sites impersonating AT&T PhishDestroy has recorded 68 phishing domains impersonating AT&T since 2025-10-14, 0 of them in the last 30 days. The most used registrars are MarkMonitor and Safenames; the most common TLDs are .io and .com. Open AT&T only from its official app or a saved bookmark. 68Domains, all time 0Last 30 days 21Online at last check 61Confirmed takedowns ## New domains in the last 90 days AT&T phishing domains detected per day: 0 from 2026-07-25 to 2026-10-22; peak 1. ## How to tell a fake AT&T site Words most often added to the brand in reported domains: bellsouth, sign, weeblysite, signing, redirection, unique, attt, ailworkinsite, attonlinesit, broadatt. - Type the address yourself or use a bookmark; phishing links for AT&T arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - AT&T does not ask you to confirm your password or card details through a link in an email or SMS. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest AT&T phishing domains The 50 most recently detected domains impersonating AT&T Domain | First detected | Status at last check | Registrar | [bellsouth-att-sign-in-4f949a.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-4f949a.webflow.io/) | 2026-02-25 | Offline | MarkMonitor | [regular-patterns-355532.framer.app](https://phishdestroy.io/domain/regular-patterns-355532.framer.app/) | 2026-02-25 | Offline | CSC Corporate Domains | [bellsouth-att-sign-in-5c7603.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-5c7603.webflow.io/) | 2026-02-21 | Offline | NameCheap | [at-t-d7e7ee.webflow.io](https://phishdestroy.io/domain/at-t-d7e7ee.webflow.io/) | 2026-02-19 | Offline | NameCheap | [sbc-d25516.webflow.io](https://phishdestroy.io/domain/sbc-d25516.webflow.io/) | 2026-02-16 | Offline | NameCheap | [2025-att-confirm-email.weeblysite.com](https://phishdestroy.io/domain/2025-att-confirm-email.weeblysite.com/) | 2026-02-15 | Taken down | SafeNames | [a72fcb49-d28a-4223-9338-f24d8ccf01b9-00-rzey68jeql2m.kirk.replit.dev](https://phishdestroy.io/domain/a72fcb49-d28a-4223-9338-f24d8ccf01b9-00-rzey68jeql2m.kirk.replit.dev/) | 2026-02-07 | Taken down | NameCheap | [atttttt108068.weeblysite.com](https://phishdestroy.io/domain/atttttt108068.weeblysite.com/) | 2026-02-03 | Taken down | SafeNames | [attnet-108557.weeblysite.com](https://phishdestroy.io/domain/attnet-108557.weeblysite.com/) | 2026-02-03 | Taken down | SafeNames | [attinfo-107427-102340.weeblysite.com](https://phishdestroy.io/domain/attinfo-107427-102340.weeblysite.com/) | 2026-02-03 | Taken down | SafeNames | [attmailupdate-105825.weeblysite.com](https://phishdestroy.io/domain/attmailupdate-105825.weeblysite.com/) | 2026-02-03 | Taken down | SafeNames | [attofficeadmin.weebly.com](https://phishdestroy.io/domain/attofficeadmin.weebly.com/) | 2026-01-31 | Taken down | Squarespace Domains II | [att-currently101.square.site](https://phishdestroy.io/domain/att-currently101.square.site/) | 2026-01-22 | Taken down | MarkMonitor | [att-login-4198.weeblysite.com](https://phishdestroy.io/domain/att-login-4198.weeblysite.com/) | 2026-01-18 | Taken down | SafeNames | [ambitious-objects-055440.framer.app](https://phishdestroy.io/domain/ambitious-objects-055440.framer.app/) | 2026-01-02 | Taken down | CSC Corporate Domains | [neveergiveup.weebly.com](https://phishdestroy.io/domain/neveergiveup.weebly.com/) | 2026-01-02 | Taken down | Safenames | [bellsouth-att-sign-in-ccb981.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-ccb981.webflow.io/) | 2026-01-02 | Taken down | MarkMonitor | [bellsouth-att-sign-in-339ec8.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-339ec8.webflow.io/) | 2025-12-29 | Taken down | MarkMonitor | [bellsouth-att-sign-in-033b77.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-033b77.webflow.io/) | 2025-12-28 | Taken down | MarkMonitor | [pelumipeller.weebly.com](https://phishdestroy.io/domain/pelumipeller.weebly.com/) | 2025-12-28 | Taken down | Safenames | [bellsouth-att-sign-in-a4f187.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-a4f187.webflow.io/) | 2025-12-26 | Taken down | Webflow | [att021.weebly.com](https://phishdestroy.io/domain/att021.weebly.com/) | 2025-12-22 | Taken down | Safenames | [attmailboxcheck1111.weebly.com](https://phishdestroy.io/domain/attmailboxcheck1111.weebly.com/) | 2025-12-22 | Taken down | Safenames | [bellsouth-att-validation-sign-in-site.webflow.io](https://phishdestroy.io/domain/bellsouth-att-validation-sign-in-site.webflow.io/) | 2025-12-20 | Taken down | MarkMonitor | [bellsouth-att-sign-in-4e0e0b.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-4e0e0b.webflow.io/) | 2025-12-18 | Taken down | MarkMonitor | [bellsouth-att-sign-in-c769af.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-c769af.webflow.io/) | 2025-12-18 | Taken down | MarkMonitor | [bellsouth-att-sign-in-423dfb.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-423dfb.webflow.io/) | 2025-12-18 | Taken down | MarkMonitor | [bellsouth-att-signing-a46195.webflow.io](https://phishdestroy.io/domain/bellsouth-att-signing-a46195.webflow.io/) | 2025-12-18 | Taken down | MarkMonitor | [bellsouth-att-sign-in-87e71e.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-87e71e.webflow.io/) | 2025-12-18 | Taken down | MarkMonitor | [bellsouth-att-sign-in-fdbdf1.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-fdbdf1.webflow.io/) | 2025-12-14 | Taken down | MarkMonitor | [bellsouth-att-sign-in-02e55b.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-02e55b.webflow.io/) | 2025-12-14 | Taken down | MarkMonitor | [bellsouth-att-sign-in-verification.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-verification.webflow.io/) | 2025-12-13 | Taken down | MarkMonitor | [bellsouth-att-sign-in-4b8c33.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-4b8c33.webflow.io/) | 2025-12-13 | Taken down | MarkMonitor | [bellsouth-att-sign-in-f487e4.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-f487e4.webflow.io/) | 2025-12-09 | Taken down | MarkMonitor | [bellsouth-att-sign-in-abe8d5.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-abe8d5.webflow.io/) | 2025-12-09 | Taken down | MarkMonitor | [attyahoomail-servicescomms.weeblysite.com](https://phishdestroy.io/domain/attyahoomail-servicescomms.weeblysite.com/) | 2025-12-08 | Taken down | Safenames | [att-bonus.com.mx](https://phishdestroy.io/domain/att-bonus.com.mx/) | 2025-12-07 | Online | GoDaddy.com | [att-103446-103201.weeblysite.com](https://phishdestroy.io/domain/att-103446-103201.weeblysite.com/) | 2025-12-06 | Taken down | Safenames | [oeze5y57b26xn8zk.umso.co](https://phishdestroy.io/domain/oeze5y57b26xn8zk.umso.co/) | 2025-12-02 | Taken down | Name.com | [currentlyattcommsyahoonet.weeblysite.com](https://phishdestroy.io/domain/currentlyattcommsyahoonet.weeblysite.com/) | 2025-11-26 | Taken down | Safenames | [524fb8att0w2curr3ntly82view9ir58ios2.netlify.app](https://phishdestroy.io/domain/524fb8att0w2curr3ntly82view9ir58ios2.netlify.app/) | 2025-11-26 | Taken down | Netlify | [bellsouth-att-signing-b613f6.webflow.io](https://phishdestroy.io/domain/bellsouth-att-signing-b613f6.webflow.io/) | 2025-11-26 | Taken down | MarkMonitor | [att-currrently-3435.weeblysite.com](https://phishdestroy.io/domain/att-currrently-3435.weeblysite.com/) | 2025-11-23 | Taken down | Safenames | [attmessageattyahoomail.weeblysite.com](https://phishdestroy.io/domain/attmessageattyahoomail.weeblysite.com/) | 2025-11-23 | Taken down | Safenames | [bellsouth-att-signing-c0218f.webflow.io](https://phishdestroy.io/domain/bellsouth-att-signing-c0218f.webflow.io/) | 2025-11-21 | Taken down | MarkMonitor | [home-8mhvx.wstd.io](https://phishdestroy.io/domain/home-8mhvx.wstd.io/) | 2025-11-21 | Taken down | NameCheap | [bellsouth-att-sign-in-9f0da3.webflow.io](https://phishdestroy.io/domain/bellsouth-att-sign-in-9f0da3.webflow.io/) | 2025-11-20 | Taken down | MarkMonitor | [site-8bbeubmoo.godaddysites.com](https://phishdestroy.io/domain/site-8bbeubmoo.godaddysites.com/) | 2025-11-19 | Taken down | GoDaddy.com | [b82cd36b-0655-4db7-831c-ecc9395c47fc-00-22erhkkddlebh.worf.replit.dev](https://phishdestroy.io/domain/b82cd36b-0655-4db7-831c-ecc9395c47fc-00-22erhkkddlebh.worf.replit.dev/) | 2025-11-18 | Taken down | Replit | [site-h1gzufxrm.godaddysites.com](https://phishdestroy.io/domain/site-h1gzufxrm.godaddysites.com/) | 2025-11-15 | Taken down | GoDaddy.com | [All 68 AT&T reports](https://phishdestroy.io/domain/?brand=AT&T) ## Where they are registered and hosted ### Registrars - [MarkMonitor](https://phishdestroy.io/registrar/markmonitor/)33 - Safenames9 - SafeNames6 - [NameCheap](https://phishdestroy.io/registrar/namecheap/)5 - CSC Corporate Domains4 - [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)3 - Safenames3 - Replit1 ### Top-level domains - [.io](https://phishdestroy.io/tld/io/)37 - [.com](https://phishdestroy.io/tld/com/)21 - [.app](https://phishdestroy.io/tld/app/)4 - [.dev](https://phishdestroy.io/tld/dev/)2 - [.website](https://phishdestroy.io/tld/website/)1 - [.co](https://phishdestroy.io/tld/co/)1 - [.mx](https://phishdestroy.io/tld/mx/)1 - [.site](https://phishdestroy.io/tld/site/)1 ### Hosting networks - CLOUDFLARENET, US33 - WEEBLY, US13 - WEEBLY - Weebly, Inc., US7 - AMAZON-02, US6 - CLOUDFLARENET - Cloudflare, Inc., US4 - GOOGLE-CLOUD-PLATFORM, US1 - AMAZON-AES, US1 - TIMWE Servicios Tecnologicos TIM SL, ES1 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is AT&T; share of all PhishDestroy reports: 0.03%. Canonical: https://phishdestroy.io/brand/at-t/