bellsouth-verifier-sign-in-fd1977[.]webflow[.]io

Analysis of bellsouth-verifier-sign-in-fd1977.webflow.io indicates active phishing infrastructure as of August 07, 2026. The domain is listed on two security blocklists and has been blocked by both PhishDestroy and OpenPhish, confirming that it is recognized by reputable anti‑phishing feeds. DNS resolution points to the address 104.18.36.248, which is a Cloudflare‑served IP commonly leveraged for fast‑flux and content‑delivery services; no further attribution to a specific autonomous system or geographic location is provided in the current data set.

VirusTotal reports that 12 of 91 scanned security vendors flag the domain, suggesting a measurable level of malicious detection across multiple engines. No additional public metadata such as SSL certificate details, registrar information, or page title has been disclosed, so the visual or functional characteristics of the hosted page remain unverified.

Defenders should continue to block the domain at perimeter devices, update URL filtering lists to include it, and monitor outbound connections for traffic to 104.18.36.248. Because the domain is actively listed on blocklists and has multiple vendor detections, it should be treated as high‑confidence phishing risk until takedown or remediation is confirmed.