bellsouth-att-sign-in-a33d19[.]webflow[.]io

Analysis of bellsouth-att-sign-in-a33d19.webflow.io indicates a high-risk brand impersonation domain targeting AT&T customers. The domain, hosted on Cloudflare infrastructure (IP 172.64.151.8, AS13335), was flagged for social engineering by Google Safe Browsing and appears on at least one security blocklist. The page title 'bellsouth att sign In' directly references AT&T's legacy Bellsouth service, confirming the intended brand deception. While the domain is currently offline (HTTP 404), historical data shows it was registered through MarkMonitor in May 2013, though this registration date predates typical phishing domain patterns and may reflect domain repurposing.

VirusTotal detections from 15 of 95 security vendors further support malicious classification, though the specific payload or phishing kit remains unconfirmed. The SSL certificate (Google Trust Services / WE1) is valid but provides no inherent trust, as legitimate certificates are commonly used in phishing operations. Cloudflare nameservers (journey.ns.cloudflare.com, lamar.ns.cloudflare.com) and HTTP/3 support suggest modern infrastructure, though these are not exclusive to malicious activity. Defenders should treat this domain as confirmed malicious based on brand impersonation, detection vendor flags, and Safe Browsing classification.

The offline status may indicate takedown or temporary suspension, but historical phishing domains often resurface. Recommended actions include blocking the domain and IP at network perimeter controls, monitoring for related subdomains or redirects, and alerting users to potential AT&T credential theft attempts. No evidence currently links this domain to broader campaign infrastructure, but defenders should correlate with other AT&T-themed phishing domains for pattern analysis.