account-att-com-b94bef[.]webflow[.]io

This domain, account-att-com-b94bef.webflow.io, is currently active and has been identified as a credential phishing vector. Registration information shows it was created through the Webflow service, a popular website‑building platform that supplies both hosting and DNS. DNS resolution points to the IPv4 address 172.64.151.8, an address associated with a large content‑delivery network, indicating the operator is leveraging reputable infrastructure to improve availability and evade simple host‑based blocking. VirusTotal has recorded 12 positive detections out of 91 scanned engines, demonstrating that a minority of security products already flag the host as malicious.

The domain also appears on a single external blocklist and is explicitly listed by the PhishDestroy feed, confirming that at least one dedicated anti‑phishing repository has taken remediation action. No public page title, SSL certificate details, or HTTP response codes have been disclosed, so the exact content delivered to victims remains unknown. Consequently, defenders cannot confirm the visual appearance of the login page or the specific credential‑capture technique employed.

However, the observable infrastructure signals deliberate abuse: the use of a legitimate hosting provider, a shared CDN IP, and early detection by multiple vendors. Recommended mitigations include adding the fully qualified domain name to network‑level deny lists, configuring web‑proxy or DNS filtering to block resolution, and monitoring outbound connections to the identified IP for anomalous authentication traffic. Organizations should also educate users about unexpected login prompts that reference accounts unrelated to the brand suggested by the domain name, and enforce multi‑factor authentication wherever possible to limit the impact of compromised credentials.