bellsouth-att-sign-in-verification[.]webflow[.]io

The domain bellsouth-att-sign-in-verification.webflow.io is identified as a high-risk phishing infrastructure specifically designed for brand impersonation targeting AT&T. This domain is currently offline but was actively used to deceive users into submitting sensitive credentials through a fraudulent sign-in portal mimicking legitimate AT&T services. The page title, Bellsouth-att-sign-in-verification, directly references the targeted brand, increasing the likelihood of successful social engineering attacks against AT&T customers. Analysis indicates this domain was flagged by 19 of 95 security vendors on VirusTotal, demonstrating broad detection across the security community. Registered through MarkMonitor, Inc. on May 08, 2013, the domain resolves to the IP address 172.64.151.8, hosted on Cloudflare’s network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), which, while legitimate, is often exploited by threat actors to lend credibility to malicious sites. The domain appears on two security blocklists and is blocked by multiple threat intelligence feeds, including PhishDestroy and PhishingDB. Google Safe Browsing also categorizes this domain as phishing, further validating its malicious intent. As of the latest assessment, bellsouth-att-sign-in-verification.webflow.io has been taken offline, reducing immediate risk to users. However, the infrastructure remains a documented threat, and similar domains may emerge. Organizations and individuals are advised to monitor for related phishing attempts, particularly those impersonating AT&T or other telecommunications providers. Network defenders should update blocklists to include this domain and its associated IP address. Users who may have interacted with this site should immediately reset their credentials and enable multi-factor authentication on all critical accounts. Security teams are encouraged to review logs for connections to 172.64.151.8 and investigate any unauthorized access attempts.