sbcglobal-att-signing-c4af42[.]webflow[.]io

This domain, sbcglobal-att-signing-c4af42.webflow.io, is flagged for credential phishing, a threat type designed to harvest user login credentials through deceptive login portals. The risk level is classified as elevated due to its active targeting of authentication details, which can lead to unauthorized account access, data breaches, or further exploitation in secondary attack vectors. Analysis indicates the domain was operational despite its current offline status, suggesting prior malicious activity. Infrastructure analysis reveals the domain resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335) in the United States. It is registered through MarkMonitor, Inc., a registrar commonly associated with both legitimate and malicious domains. The domain was created on February 27, 2026, an unusually future-dated registration that may indicate an attempt to evade detection or align with planned attack timelines. Security vendor detections on VirusTotal report 18 out of 95 engines flagging the domain as malicious, while it appears on at least one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority that does not inherently validate domain legitimacy. The page title, "404 - Page not found," suggests either a takedown, evasion tactic, or placeholder status post-compromise. Mitigation against credential phishing domains like this requires a multi-layered approach. Network-level protections should include blocking the domain and its associated IP address (104.18.36.248) at firewalls and DNS resolvers. Endpoint security measures should enforce real-time URL filtering to prevent access to known phishing domains. Organizations should implement multi-factor authentication (MFA) to reduce the impact of credential theft, even if initial login details are compromised. User awareness training should emphasize recognizing phishing indicators, such as spoofed branding, urgency tactics, and mismatched URLs. Security teams are advised to monitor logs for connections to this domain or its IP, as prior access may indicate successful credential harvesting attempts. If credentials were entered on this domain, immediate password resets and account audits are recommended.