bellsouth-att-sign-in-e259eb[.]webflow[.]io

Analysis of bellsouth-att-sign-in-e259eb.webflow.io, observed on July 23, 2026, indicates a high‑risk brand‑impersonation campaign targeting AT&T. The domain, registered through MarkMonitor, Inc., was created on May 08, 2013 and currently resolves to the IP address 172.64.151.8, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents the page title "bellsouth att sign In" and returns an HTTP 404 status, confirming that the content is no longer accessible; the domain is listed as taken offline. Security‑relevant observations include a Google Safe Browsing classification of social engineering and a VirusTotal detection count of 14 out of 95 scanned vendors, demonstrating that multiple security products flag the domain as malicious.

The domain appears on a single external blocklist and is actively blocked by PhishDestroy. Infrastructure analysis shows the use of Cloudflare services with HTTP/3 enabled and nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the WE1 label, providing standard HTTPS encryption but not mitigating the underlying impersonation risk. Scamadviser assigns a trust score of 1 out of 100, reflecting extreme lack of credibility.

While the site content cannot be examined directly due to the 404 response, the convergence of brand‑impersonation indicators, multiple vendor detections, and blocklist presence warrants immediate defensive action. Organizations should add the domain and its resolving IP to outbound filtering rules, monitor for related traffic to Cloudflare edge nodes, and ensure that any credential‑capture attempts referencing AT&T are blocked. Continuous threat‑intel feeds should be consulted for potential reuse of the same infrastructure in future campaigns.