# Phishing sites impersonating Att PhishDestroy has recorded 83 phishing domains impersonating Att since 2026-02-24, 3 of them in the last 30 days. The most used registrars are MarkMonitor and Webflow; the most common TLDs are .com and .app. Open Att only from its official app or a saved bookmark. 83Domains, all time 3Last 30 days 42Online at last check 13Confirmed takedowns ## New domains in the last 90 days Att phishing domains detected per day: 16 from 2026-07-25 to 2026-10-22; peak 3. ## How to tell a fake Att site Words most often added to the brand in reported domains: weeblysite, sign, secure, page, mobile, flexcontrol, verifier, bclubb, bellsouth, bclub. - Type the address yourself or use a bookmark; phishing links for Att arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - Att does not ask you to confirm your password or card details through a link in an email or SMS. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest Att phishing domains The 50 most recently detected domains impersonating Att Domain | First detected | Status at last check | Registrar | [bclubb.net](https://phishdestroy.io/domain/bclubb.net/) | 2026-09-25 | Online | NICENIC | [demo.mosci.ai](https://phishdestroy.io/domain/demo.mosci.ai/) | 2026-09-25 | Online | NAMECHEAP | [month13mobile.com](https://phishdestroy.io/domain/month13mobile.com/) | 2026-09-25 | Online | NAMECHEAP | [androshchuknastya.github.io](https://phishdestroy.io/domain/androshchuknastya.github.io/) | 2026-09-12 | Offline | GitHub Pages | [account-att-com-cb52f4.webflow.io](https://phishdestroy.io/domain/account-att-com-cb52f4.webflow.io/) | 2026-09-05 | Offline | Webflow | [relevant-population-068691.framer.app](https://phishdestroy.io/domain/relevant-population-068691.framer.app/) | 2026-08-31 | Offline | Framer | [atatmyaccount.blogspot.com](https://phishdestroy.io/domain/atatmyaccount.blogspot.com/) | 2026-08-31 | Online | Google | [essentialoilroots.com](https://phishdestroy.io/domain/essentialoilroots.com/) | 2026-08-11 | Online | GoDaddy.com | [keen-viper-0088.typedream.app](https://phishdestroy.io/domain/keen-viper-0088.typedream.app/) | 2026-08-07 | Online | Typedream | [redirectmail-attlogin.weebly.com](https://phishdestroy.io/domain/redirectmail-attlogin.weebly.com/) | 2026-08-07 | Offline | Square | [sign-in-66e8c0.webflow.io](https://phishdestroy.io/domain/sign-in-66e8c0.webflow.io/) | 2026-08-07 | Offline | Webflow | [document-sign-online--xfinityweb.replit.app](https://phishdestroy.io/domain/document-sign-online--xfinityweb.replit.app/) | 2026-08-06 | Online | Replit | [bundleadmin.azurewebsites.net](https://phishdestroy.io/domain/bundleadmin.azurewebsites.net/) | 2026-08-04 | Online | Microsoft | [factiliate.de](https://phishdestroy.io/domain/factiliate.de/) | 2026-08-04 | Online | — | [jackrunyon-lgtm.github.io](https://phishdestroy.io/domain/jackrunyon-lgtm.github.io/) | 2026-07-31 | Offline | GitHub | [att-process-navigator-ff48ed14.buildaispace.app](https://phishdestroy.io/domain/att-process-navigator-ff48ed14.buildaispace.app/) | 2026-07-29 | Online | GoDaddy.com | [sbcverify-1e6d20.webflow.io](https://phishdestroy.io/domain/sbcverify-1e6d20.webflow.io/) | 2026-07-22 | Offline | Webflow | [att-internet.serviceroute.site](https://phishdestroy.io/domain/att-internet.serviceroute.site/) | 2026-07-22 | Online | Spaceship | [simple-docs--webmailprompt1.replit.app](https://phishdestroy.io/domain/simple-docs--webmailprompt1.replit.app/) | 2026-07-21 | Online | Replit | [sbcverification.webflow.io](https://phishdestroy.io/domain/sbcverification.webflow.io/) | 2026-07-17 | Offline | Webflow | [secure-page-builder--att-curent.replit.app](https://phishdestroy.io/domain/secure-page-builder--att-curent.replit.app/) | 2026-07-17 | Online | Replit | [secure-static-page--summitlandscape.replit.app](https://phishdestroy.io/domain/secure-static-page--summitlandscape.replit.app/) | 2026-07-17 | Online | Replit | [attmailyahoo.net](https://phishdestroy.io/domain/attmailyahoo.net/) | 2026-07-07 | Online | DomainPeople | [sbcverify-f0f7ef.webflow.io](https://phishdestroy.io/domain/sbcverify-f0f7ef.webflow.io/) | 2026-07-02 | Offline | Webflow | [www-att-bellsouth-verifier-cf9dde.webflow.io](https://phishdestroy.io/domain/www-att-bellsouth-verifier-cf9dde.webflow.io/) | 2026-07-01 | Offline | Webflow | [6a2d930d1db5f3344b65a808--gleeful-mermaid-933ec5.netlify.app](https://phishdestroy.io/domain/6a2d930d1db5f3344b65a808--gleeful-mermaid-933ec5.netlify.app/) | 2026-06-23 | Offline | Netlify | [secure-index-page--prestoconstruct.replit.app](https://phishdestroy.io/domain/secure-index-page--prestoconstruct.replit.app/) | 2026-06-23 | Online | Nom-IQ dba Com Laude | [attvip.mx](https://phishdestroy.io/domain/attvip.mx/) | 2026-06-18 | Online | GoDaddy.com | [cardlamp-bit.github.io](https://phishdestroy.io/domain/cardlamp-bit.github.io/) | 2026-06-16 | Offline | GitHub | [ubiquitous-gingersnap-809853.netlify.app](https://phishdestroy.io/domain/ubiquitous-gingersnap-809853.netlify.app/) | 2026-06-16 | Offline | Netlify | [6a305e2813dfbd3fb78810c4--ubiquitous-gingersnap-809853.netlify.app](https://phishdestroy.io/domain/6a305e2813dfbd3fb78810c4--ubiquitous-gingersnap-809853.netlify.app/) | 2026-06-16 | Offline | Netlify | [6a2d92a9d242d7b5e453154c--sweet-tarsier-be1a2a.netlify.app](https://phishdestroy.io/domain/6a2d92a9d242d7b5e453154c--sweet-tarsier-be1a2a.netlify.app/) | 2026-06-16 | Offline | Netlify | [youngmamarrero1.wixforms.com](https://phishdestroy.io/domain/youngmamarrero1.wixforms.com/) | 2026-06-15 | Online | GoDaddy.com | [hamsangwich.com](https://phishdestroy.io/domain/hamsangwich.com/) | 2026-06-15 | Online | Squarespace Domains | [maroon-info-652456.framer.app](https://phishdestroy.io/domain/maroon-info-652456.framer.app/) | 2026-06-10 | Offline | Framer | [capable-article-728685.framer.app](https://phishdestroy.io/domain/capable-article-728685.framer.app/) | 2026-06-07 | Offline | Framer | [sbcglobe-2648f1.webflow.io](https://phishdestroy.io/domain/sbcglobe-2648f1.webflow.io/) | 2026-06-03 | Taken down | Webflow | [admin.flexcontrol.app](https://phishdestroy.io/domain/admin.flexcontrol.app/) | 2026-05-22 | Online | GoDaddy.com | [analytical-sigma.co.za](https://phishdestroy.io/domain/analytical-sigma.co.za/) | 2026-05-15 | Online | Afrihost | [xsdwlk.weebly.com](https://phishdestroy.io/domain/xsdwlk.weebly.com/) | 2026-05-14 | Taken down | MarkMonitor | [attllp.wpenginepowered.com](https://phishdestroy.io/domain/attllp.wpenginepowered.com/) | 2026-05-13 | Online | MarkMonitor | [verifynow-8d1935.webflow.io](https://phishdestroy.io/domain/verifynow-8d1935.webflow.io/) | 2026-05-08 | Taken down | Webflow | [juner-108598.weeblysite.com](https://phishdestroy.io/domain/juner-108598.weeblysite.com/) | 2026-05-04 | Taken down | MarkMonitor | [concave-device-266580.framer.app](https://phishdestroy.io/domain/concave-device-266580.framer.app/) | 2026-04-29 | Offline | Framer | [currently-att-8-7-2024.weeblysite.com](https://phishdestroy.io/domain/currently-att-8-7-2024.weeblysite.com/) | 2026-04-20 | Taken down | MarkMonitor | [att-109117-101989.weeblysite.com](https://phishdestroy.io/domain/att-109117-101989.weeblysite.com/) | 2026-04-19 | Taken down | MarkMonitor | [babs147.weeblysite.com](https://phishdestroy.io/domain/babs147.weeblysite.com/) | 2026-04-19 | Taken down | MarkMonitor | [ndn21t.weeblysite.com](https://phishdestroy.io/domain/ndn21t.weeblysite.com/) | 2026-04-19 | Taken down | MarkMonitor | [sbcglobal-107559.weeblysite.com](https://phishdestroy.io/domain/sbcglobal-107559.weeblysite.com/) | 2026-04-19 | Taken down | MarkMonitor | [anitrascafe.org](https://phishdestroy.io/domain/anitrascafe.org/) | 2026-04-18 | Taken down | Tucows Domains | [All 83 Att reports](https://phishdestroy.io/domain/?brand=Att) ## Where they are registered and hosted ### Registrars - [MarkMonitor](https://phishdestroy.io/registrar/markmonitor/)10 - Webflow9 - [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)7 - Framer6 - [MarkMonitor](https://phishdestroy.io/registrar/markmonitor/)4 - Netlify4 - [Tucows Domains](https://phishdestroy.io/registrar/tucows/)3 - GitHub3 ### Top-level domains - [.com](https://phishdestroy.io/tld/com/)31 - [.app](https://phishdestroy.io/tld/app/)21 - [.io](https://phishdestroy.io/tld/io/)18 - [.cc](https://phishdestroy.io/tld/cc/)3 - [.net](https://phishdestroy.io/tld/net/)3 - [.me](https://phishdestroy.io/tld/me/)1 - [.org](https://phishdestroy.io/tld/org/)1 - [.za](https://phishdestroy.io/tld/za/)1 ### Hosting networks - Cloudflare, Inc.12 - Weebly, Inc.12 - Amazon.com, Inc.10 - CLOUDFLARENET - Cloudflare, Inc., US9 - Google LLC7 - GOOGLE-CLOUD-PLATFORM - Google LLC, US3 - WEEBLY - Weebly, Inc., US3 - Fastly, Inc.3 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Att; share of all PhishDestroy reports: 0.04%. Canonical: https://phishdestroy.io/brand/att/