bellsouth-att-sigining-5d1d8c[.]webflow[.]io

PhishDestroy identifies the domain bellsouth-att-sigining-5d1d8c.webflow.io as a high-risk phishing host currently active and posing as an AT&T sign-in page. This malicious domain leverages Webflow’s infrastructure to mimic legitimate AT&T authentication flows, deceiving users into surrendering sensitive login credentials. The campaign is categorized as a generic phishing operation with a high confidence rating due to its active status and deceptive branding.

This domain was flagged by 12 of 95 VirusTotal vendors and is explicitly blocked by Google Safe Browsing under the SOCIAL_ENGINEERING category. It resolves to IP address 104.18.36.248 and operates under an SSL certificate issued by Google Trust Services, enhancing its appearance of legitimacy. The domain is hosted on Webflow’s platform, which has been abused in multiple credential harvesting campaigns. While exact creation date and registrar details are not publicly disclosed in available intelligence, the combination of high detection rates, active hosting, and brand impersonation elevates the threat level significantly.

Security teams are urged to block access to bellsouth-att-sigining-5d1d8c.webflow.io at the network perimeter and DNS level using the domain name and resolved IP (104.18.36.248). Users should be alerted through security awareness training to avoid any AT&T-themed login prompts originating from non-official domains, especially those hosted on webflow.io or similar dynamic hosting services. Immediate investigation is recommended for any internal endpoints that may have accessed this domain, including credential rotation and log review for signs of compromise. This domain represents a credible threat to organizational security due to its active status and effective impersonation tactics.