bellsouth-att-sign-in-0748a8[.]webflow[.]io

The domain bellsouth-att-sign-in-0748a8.webflow.io was observed hosting a page titled "bellsouth att sign In" and is explicitly linked to brand impersonation of AT&T. Infrastructure analysis shows the domain resolves to IP address 104.18.36.248, which belongs to AS13335 owned by Cloudflare, Inc., located in the United States. The site is protected by a Google Trust Services certificate issued to the WE1 authority, and DNS resolution is delegated to the Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. HTTP probing returned a 404 status code, and the server negotiated HTTP/3, confirming the presence of Cloudflare’s modern edge services.

VirusTotal scanned the host and recorded 14 detections out of 95 security vendors, indicating a notable malicious reputation. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. Reputation services assign a Scamadviser trust score of 1 out of 100, underscoring the high likelihood of abuse. Registration details indicate the domain was created on May 08, 2013 and was registered through MarkMonitor, Inc., a registrar commonly used for brand‑related domains.

As of the report date, the site has been taken offline, limiting immediate exposure but leaving the underlying infrastructure usable for potential future campaigns. Defenders should continue to block the domain and the associated IP address at perimeter and endpoint security layers, monitor for re‑registration attempts, and incorporate the observed TLS fingerprint and HTTP/3 handshake characteristics into detection rules. Ongoing watch of Cloudflare‑hosted assets targeting AT&T brand terms is recommended to catch any re‑emergence of similar impersonation attempts.