bellsouth-att-sign-in-08bbe2[.]webflow[.]io

Analysis of bellsouth-att-sign-in-08bbe2.webflow.io confirms the site is being used for credential phishing. The domain was registered on February 21, 2026 through NameCheap, Inc. and is hosted on Cloudflare infrastructure (AS13335) in the United States, resolving to IP address 172.64.151.8. The TLS certificate presented is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint despite the malicious intent. HTTP probing returns a 404 status with the page title "404 - Page not found," suggesting the malicious content has been removed or the site is deliberately serving a not‑found response while still being tracked by security services.

VirusTotal scans show that 15 of 93 security vendors label the domain as malicious, and the site appears on a single external blocklist. PhishDestroy has actively blocked the domain, and Google Safe Browsing flags it for social engineering. The combination of Cloudflare’s HTTP/3 support, a legitimate‑looking certificate, and the social‑engineering flag aligns with the observed credential‑phishing campaign. Uncertainty remains regarding the current payload or lure because the live page no longer serves visible content; the 404 response limits direct content analysis.

However, the existing intelligence—registrar data, hosting details, detection counts, and safe‑browsing classification—provides sufficient evidence for defensive action. Organizations should immediately add the domain and its resolving IP to outbound and inbound deny lists, monitor DNS queries for related subdomains, and enforce URL filtering based on the Google Safe Browsing and PhishDestroy listings. Continuous re‑evaluation is advised in case the site becomes active again or additional indicators emerge.