bellsouth-att-sign-in-87e71e[.]webflow[.]io

The domain bellsouth-att-sign-in-87e71e.webflow.io is a phishing site that impersonates AT&T. It has been flagged by 16 out of 95 vendors on VirusTotal. Google Safe Browsing also marks it as malicious, and it appears on one public blocklist, specifically PhishDestroy's. The site is currently offline, but its previous activity indicates a targeted attack on telecom users.

This domain was registered with MarkMonitor, Inc. and hosted on an IP address managed by Cloudflare, Inc. in the United States. The SSL certificate was issued by Google Trust Services, which is a common practice for phishing sites trying to appear legitimate. The domain's creation date traces back to 2013, but it was first detected by PhishDestroy in December 2025, suggesting it may have been dormant or inactive until recently.

The phishing site aimed to deceive AT&T customers into entering their login credentials by mimicking the official sign-in page. Such domains exploit the trust users have in familiar brands, making them particularly effective. Despite being taken down, the domain highlights the ongoing threat of telecom-related phishing attacks. PhishDestroy's early detection capabilities play a crucial role in identifying these threats before they propagate widely across antivirus databases.