bellsouth-att-sign-in-f487e4[.]webflow[.]io

The domain bellsouth-att-sign-in-f487e4.webflow.io was observed hosting a brand‑impersonation campaign targeting AT&T. Technical inspection shows the domain resolves to 172.64.151.8, an address owned by AS13335 Cloudflare, Inc., located in the United States. The site was served behind Cloudflare’s network and advertised support for HTTP/3, confirming the use of modern CDN infrastructure. SSL termination is provided by Google Trust Services under the WE1 certificate, indicating a valid TLS handshake despite the malicious purpose. The domain’s nameservers, journey.ns.cloudflare.com and lamar.ns.cloudflare.com, are also Cloudflare‑controlled.

Registration data lists MarkMonitor, Inc. as the registrar, and the domain creation timestamp is May 08 2013, suggesting the name may have been repurposed for the campaign rather than recently registered. The page title returned by the HTTP request was "bellsouth att sign In" and the HTTP status was 404, meaning the expected landing page is no longer reachable. The site was listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service. VirusTotal analysis recorded detections from 17 of 95 scanned vendors, reinforcing the classification as malicious.

A Scamadviser trust score of 1 out of 100 further underscores the low credibility of the host. Current status is offline, but the infrastructure components—Cloudflare front‑end, Google TLS, and the MarkMonitor registrar—remain reusable for future impersonation attempts. Defenders should continue to block the domain at perimeter filters, monitor the associated IP address and Cloudflare nameservers for re‑use, and update any AT&T brand‑specific URL allowlists to exclude similar patterns. Continuous vigilance is advised because the underlying hosting platform can be rapidly reconfigured for new phishing operations.