bellsouth-att-sign-in-f6599f[.]webflow[.]io

PhishDestroy identifies bellsouth-att-sign-in-f6599f.webflow.io as an active AT&T credential-harvesting site operating since seed 926eb1. This domain masquerades as a legitimate BellSouth/AT&T sign-in portal to trick users into surrendering email and password combinations. The page title mirrors the branding victims expect, lowering suspicion while the threat remains fully functional. This domain was flagged by 20 of 95 VirusTotal scanners, blocked by OpenPhish, and resolved to IP 172.64.151.8. It hides behind a Google Trust Services SSL certificate to appear trustworthy; however, the subdomain webflow.io reveals it is an unauthorized staging environment rather than an official AT&T property. OpenPhish has listed it on at least one blocklist since its activation, yet the site continues to operate and lure targets. If you visited bellsouth-att-sign-in-f6599f.webflow.io and entered any AT&T or email credentials, change your password immediately using a known-safe device and enable multi-factor authentication. Scan the device you used with updated antivirus software, revoke any saved browser sessions tied to the account, and report the incident to AT&T’s fraud line. Never reuse the exposed password on other services. Monitor your account for unauthorized activity and consider a credit freeze if financial or PII was also exposed.