bellsouth-att-sign-in-fdbdf1[.]webflow[.]io

This domain, bellsouth-att-sign-in-fdbdf1.webflow.io, operates as a credential harvesting phishing site designed to impersonate AT&T’s official login portal. The site mimics the appearance of legitimate AT&T/Bellsouth authentication pages, tricking users into entering sensitive account details such as usernames, passwords, and potentially payment information. The primary threat posed by this domain is unauthorized account access, which could lead to identity theft, financial fraud, or further exploitation of compromised credentials across other platforms. Analysis indicates this domain was registered through MarkMonitor, Inc. on May 8, 2013, though the phishing content appears to have been deployed more recently. Infrastructure analysis reveals the domain resolves to 104.18.36.248, hosted on Cloudflare’s network (AS13335). The site’s SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. Security vendors flagged this domain in 17 out of 95 scans on VirusTotal, with Google Safe Browsing explicitly classifying it as phishing. Additionally, the domain appears on at least one security blocklist and has since been taken offline. If you visited bellsouth-att-sign-in-fdbdf1.webflow.io and entered login credentials or other sensitive information, immediate action is required. First, change the passwords for any accounts using the same or similar credentials, prioritizing email, financial, and AT&T-related services. Enable multi-factor authentication (MFA) where available to add an extra layer of security. Monitor accounts for unauthorized activity, such as unfamiliar transactions or login attempts, and report any suspicious behavior to the affected service provider. Consider notifying credit agencies to place a fraud alert if financial information was exposed. Users should also scan their devices for malware, as phishing sites may distribute additional payloads.