bellsouth-att-sign-in-a57ce0[.]webflow[.]io

Analysis of the domain bellsouth-att-sign-in-a57ce0.webflow.io confirms its classification as an AT&T credential phishing site. The domain, hosted on Webflow's infrastructure, resolves to the IP address 104.18.36.248, which is part of Cloudflare's network (AS13335) located in the United States. The nameservers, journey.ns.cloudflare.com and lamar.ns.cloudflare.com, further indicate Cloudflare's involvement in the domain's DNS resolution. The domain was initially registered on May 8, 2013, through MarkMonitor, Inc., though this registration date likely reflects the creation of the parent webflow.io subdomain rather than the malicious subdomain itself, which appears to have been recently repurposed for phishing activity. The page title, 'bellsouth att sign In,' directly references AT&T's Bellsouth service, a legacy brand under AT&T, confirming the intent to impersonate the telecommunications provider for credential harvesting.

As of the report date, the domain is offline, returning an HTTP 404 status, which may indicate takedown action or voluntary suspension by the hosting provider. The domain appears on one security blocklist, specifically PhishDestroy, and is flagged by 14 out of 95 security vendors on VirusTotal, reinforcing its malicious classification. Scamadviser assigns the domain a trust score of 1 out of 100, reflecting its high-risk nature. Infrastructure analysis reveals the use of a Google Trust Services SSL certificate (WE1), which, while providing encryption, does not mitigate the domain's malicious intent.

The combination of Cloudflare hosting, a low trust score, and direct brand impersonation aligns with known phishing tactics. Defenders are advised to block the domain and its resolving IP (104.18.36.248) at the network level, and to monitor for similar subdomains under webflow.io or other content delivery platforms.