account-att-com-17bd1d[.]webflow[.]io

This domain, account-att-com-17bd1d.webflow.io, is actively flagged as a credential phishing site targeting AT&T customers. Analysis indicates the domain is hosted on Webflow's infrastructure, a platform frequently abused for rapid phishing site deployment due to its ease of use and free tier availability. As of August 04, 2026, the domain appears on one security blocklist, specifically PhishDestroy, which categorizes it as a phishing threat. VirusTotal scans reveal that 16 out of 91 security vendors detect the domain as malicious, providing concrete evidence of its suspicious nature.

The exact content of the site remains unanalyzed, but the presence on multiple detection platforms and a blocklist suggests it is designed to harvest login credentials by impersonating an AT&T authentication portal. Infrastructure analysis reveals the domain leverages Webflow's hosting services, which may obscure the true origin of the threat actor. No registrar or IP details are currently available, limiting attribution efforts. The domain's SSL certificate, likely issued by Webflow's default provider, does not provide additional indicators of compromise.

Defenders should treat this domain as an active threat and implement blocking measures at the network and endpoint levels. Organizations using Webflow for legitimate purposes should monitor for unauthorized deployments and review access controls to prevent abuse. Given the elevated risk level, users encountering this domain should avoid interaction and report it to their security teams for further investigation.