bellsouth-att-sign-in-850e6d[.]webflow[.]io

This domain, bellsouth-att-sign-in-850e6d.webflow.io, is identified as a high-risk phishing site specifically designed to harvest AT&T customer credentials. Analysis confirms the domain was actively used in credential theft campaigns targeting users of the telecommunications provider. The site is currently offline, though prior infrastructure remains a potential indicator of compromise. Infrastructure analysis reveals the domain was registered through NameCheap, Inc. on February 24, 2026, an unusually future-dated creation timestamp suggesting possible obfuscation or misconfiguration. It resolved to IP address 104.18.36.248, hosted on AS13335 (Cloudflare, Inc.) infrastructure in the United States. The domain appears on one security blocklist and is flagged by Google Safe Browsing as phishing. VirusTotal reports 20 of 95 security vendors detecting malicious activity associated with this domain. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority used by both legitimate and malicious sites. Current status indicates the domain is offline, though residual risk remains for users who may have interacted with it during its active phase. Organizations are advised to block the domain and associated IP (104.18.36.248) at perimeter security controls. Network administrators should review logs for connections to this domain or IP address, particularly from endpoints with access to sensitive credentials. Users should be instructed to reset any passwords entered on this site and enable multi-factor authentication where available. Monitoring for similar domains using the same naming pattern (e.g., bellsouth-att-sign-in-*) is recommended.