www-att-bellsouth-verifier-cf9dde[.]webflow[.]io

This domain, www-att-bellsouth-verifier-cf9dde.webflow.io, is flagged as a high-risk credential phishing site impersonating AT&T's Bellsouth billing verification portal. Analysis indicates the threat actor targets customer account credentials through a fraudulent login interface, mimicking legitimate AT&T authentication flows. The page title, www.att.bellsouth.verifier, reinforces the deception by closely resembling official AT&T subdomains. No drainer kit signatures were identified, suggesting a custom-built or lightly modified phishing template designed for this campaign. Infrastructure analysis reveals the domain is hosted on a content delivery network, resolving to IP address 104.18.36.248. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy while evading basic TLS inspection warnings. VirusTotal detection metrics show 16 out of 95 security vendors have flagged this domain as malicious, with a notable absence from Google Safe Browsing at the time of assessment. The registrar is Webflow, a platform frequently abused for rapid phishing site deployment due to its ease of use and free tier availability. Creation date metadata is obscured by the hosting provider, but passive DNS records indicate the domain became active within the last 72 hours. Current status remains active, with no takedown or sinkholing observed. The domain continues to serve phishing content to visitors, maintaining operational persistence through CDN-based hosting. Recommended response actions include immediate blocklisting at the network perimeter, submission to additional threat intelligence feeds, and monitoring for credential reuse attempts against AT&T customer accounts. Remaining risk is elevated due to the domain's continued availability, professional-grade impersonation, and low detection rates among major security vendors. Organizations should prioritize user education on recognizing billing portal phishing attempts and implement multi-factor authentication to mitigate credential theft impact.