account-att-com-6fee3b[.]webflow[.]io

This domain, account-att-com-6fee3b.webflow.io, is currently classified as a high‑risk credential‑phishing site. The infrastructure is hosted on the IP address 104.18.36.248, which is associated with the Webflow hosting platform. Registration information indicates the domain was created through Webflow, Inc., and no explicit nameserver records were returned during lookup. The domain has been added to two public blocklists and is actively blocked by the PhishDestroy and OpenPhish feeds, confirming that multiple threat‑intelligence sources have observed malicious use.

VirusTotal analysis shows that 18 of 91 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of credential‑phishing activity. The unique seed 80a479 ties this report to a specific investigative run, ensuring reproducibility of the findings. While the exact phishing payload or targeted brand has not been disclosed in the available data, the presence of a Webflow‑hosted subdomain with a name resembling an account login page is consistent with credential‑phishing tactics that harvest user credentials.

Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the IP 104.18.36.248, and incorporate the domain into endpoint detection rules. Because the nameserver information is unavailable, additional passive DNS monitoring may reveal further resolutions or related infrastructure. Continuous observation is advised, as the domain remains active and could be used in broader credential‑harvesting campaigns.