atttverriifcccatiooonnnn[.]webflow[.]io

The domain atttverriifcccatiooonnnn.webflow.io was created on May 08, 2013 and is currently marked as offline. Technical inspection shows it is hosted behind Cloudflare, using the nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and resolves to the IPv6 address 2606:4700:440c::ac40:9708, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presented a page title identical to the domain name – "atttverriifcccatiooonnnn" – and returned an HTTP 404 status code when accessed. SSL termination is provided by Google Trust Services under the WE1 certificate, indicating a valid TLS chain.

Detection data reveal that 15 out of 95 security vendors on VirusTotal flagged the domain, and it appears on a single security blocklist. Google Safe Browsing has classified the site as a social engineering threat, and the domain is listed as blocked by the PhishDestroy service. Registration information indicates the domain was acquired through MarkMonitor, Inc., a registrar commonly used for legitimate brand protection. The campaign is identified as a brand impersonation targeting AT&T, consistent with the declared threat type.

While the presence of Cloudflare and a legitimate certificate may reduce superficial suspicion, the combination of multiple vendor detections, Safe Browsing flag, and blocklist entry confirms malicious intent. Defenders should continue to block the IP address 2606:4700:440c::ac40:9708 at the network perimeter, enforce URL filtering for the fully qualified domain, and monitor for any re‑registration attempts. Additional investigation is warranted to determine whether other subdomains or related infrastructure are being leveraged for similar impersonation attempts, but no further content details are presently available.