account-att-com-4899ac[.]webflow[.]io

This domain, account-att-com-4899ac.webflow.io, is flagged as an active credential phishing threat as of August 07, 2026. The domain resolves to IP address 172.64.151.8, which is associated with Cloudflare's hosting infrastructure, a common choice for phishing sites due to its built-in proxy and SSL capabilities. Threat intelligence indicates that 15 out of 91 security vendors on VirusTotal currently flag this domain as malicious, and it appears on two separate security blocklists, including PhishDestroy and OpenPhish. While the domain name strongly suggests an impersonation of AT&T, the exact page content has not yet been analyzed, so the specific branding or login form details remain unconfirmed.

However, the combination of the domain string and the phishing classification provides a high-confidence indication of a credential harvesting attempt targeting AT&T customers. Defenders should block access to this domain at the DNS and proxy levels, and monitor for any related subdomains or variations that may emerge. Users who may have visited the site should be advised to change their AT&T credentials immediately and enable multi-factor authentication. The domain's reliance on a subdomain of webflow.io, a legitimate website builder platform, allows it to appear less suspicious to casual users and may evade some traditional URL filters.

Security teams should treat this as an elevated risk and ensure that email gateways and web filters are updated with this indicator. Continuous monitoring of VirusTotal and blocklist status is recommended, as detection counts may fluctuate. No further registration or SSL certificate details were available in the supplied intelligence at the time of this report.