bellsouth-att-sign-in-a4f187[.]webflow[.]io

This domain, bellsouth-att-sign-in-a4f187.webflow.io, operates as a credential harvesting phishing site targeting AT&T customers. The site mimics the legitimate AT&T sign-in portal, specifically using the "bellsouth att sign in" page title to deceive users into entering sensitive login credentials. Such attacks typically aim to capture usernames, passwords, and other personal information for unauthorized account access or identity theft. Analysis indicates the domain was registered through Webflow and is hosted on Cloudflare infrastructure (IP: 104.18.36.248, AS13335). It has been flagged by 18 out of 95 security vendors on VirusTotal, with additional detections from Google Safe Browsing and one other security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to appear legitimate while concealing malicious intent. If you visited this domain or entered credentials, immediately change your AT&T account password using a trusted device. Enable multi-factor authentication if not already active. Monitor your account for unauthorized activity and review connected devices or services. Avoid reusing the compromised password on other platforms. Report the incident to AT&T security teams and consider notifying relevant fraud protection services.