sbcglobal-fad703[.]webflow[.]io

This domain is flagged as a high-risk credential phishing site targeting users of a telecommunications service. Analysis indicates the infrastructure was specifically designed to harvest login credentials through deceptive login portals mimicking legitimate service providers. Infrastructure analysis reveals the domain sbcglobal-fad703.webflow.io was registered through Webflow on April 14, 2026, and resolves to IP address 172.64.151.8, hosted behind Cloudflare infrastructure in California. The site appears on one security blocklist and is currently blocked by PhishDestroy. Google Safe Browsing categorizes this domain as phishing, while VirusTotal reports 18 out of 95 security vendors detect malicious activity. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging free certificate authorities. Organizations and users should immediately block access to this domain at the network level and invalidate any credentials potentially exposed through this phishing attempt. Security teams should review authentication logs for connections to 172.64.151.8 between April 14 and the takedown date, prioritizing accounts with failed login attempts followed by successful authentication. Multi-factor authentication should be enforced for all accounts that may have been exposed to this campaign, particularly those associated with telecommunications services. The April 2026 creation date suggests this domain was registered specifically for malicious purposes, warranting additional scrutiny of similarly structured domains registered through Webflow during this period.