bellsouth-att-sign-in-71696f[.]webflow[.]io

This domain is flagged as an elevated-risk phishing site specializing in fake login credential harvesting. Analysis indicates the infrastructure was designed to impersonate a telecommunications provider login portal, likely targeting users of the associated brand to extract account credentials. The threat type is classified as a brand impersonation phishing scheme, with no evidence of secondary payload delivery such as malware or crypto drainers at this time. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain bellsouth-att-sign-in-71696f.webflow.io is detected by 18 out of 95 security vendors on VirusTotal, with a current status of offline. It was registered through MarkMonitor, Inc. and resolves to IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335). The domain was originally created on May 08, 2013, though the phishing content appears to have been deployed recently. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend legitimacy to fraudulent sites. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and the page title currently displays a 404 error, suggesting takedown or abandonment. Mitigation steps for this specific threat type include immediate credential rotation for any users who may have interacted with the site, particularly those associated with the impersonated brand. Network administrators should block the domain and its resolving IP (104.18.36.248) at the perimeter to prevent internal access. Security teams are advised to review logs for connections to the domain or IP, focusing on outbound traffic from the timeframe when the site was active. Given the use of Cloudflare infrastructure, additional scrutiny of other domains resolving to the same IP range is recommended to identify potential lateral threats. Users should be educated on recognizing brand impersonation tactics, particularly those involving login portals with mismatched URLs or unexpected certificate authorities.