bellsouth-att-validation-sign-in-site[.]webflow[.]io

Analysis of the domain bellsouth-att-validation-sign-in-site.webflow.io indicates a high-risk phishing operation impersonating AT&T, specifically targeting users through a fraudulent sign-in validation page. The domain, hosted on Cloudflare infrastructure (AS13335), resolves to IP 172.64.151.8 and uses nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The page title, 'Bellsouth-att-validation-sign-in Site,' directly references AT&T’s Bellsouth service, reinforcing the brand impersonation classification. The domain was registered through MarkMonitor, Inc. on May 8, 2013, though its malicious use appears to be recent. As of July 25, 2026, the site returns an HTTP 404 status, suggesting it has been taken offline or is no longer actively serving content.

However, prior to deactivation, it was flagged by Google Safe Browsing for social engineering and blocked by PhishDestroy. Scamadviser assigned a trust score of 1/100, further corroborating its malicious nature. Fifteen of 93 security vendors on VirusTotal detected the domain as malicious, and it appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious sites, offering no definitive indication of intent. Technologies detected include Cloudflare and HTTP/3, typical of modern phishing infrastructure designed to evade detection and improve performance.

Defenders should treat this domain as confirmed malicious, particularly for AT&T customers. While the site is currently offline, historical DNS and WHOIS records should be preserved for forensic analysis. Organizations are advised to block the domain, IP 172.64.151.8, and associated Cloudflare nameservers at perimeter security controls. No evidence of credential harvesting or payload delivery was directly observed, but the page title and brand impersonation suggest a likely attempt to capture user credentials.