bellsouth-att-signing-e99efa[.]webflow[.]io

The domain bellsouth-att-signing-e99efa.webflow.io is identified as a credential theft operation, specifically designed to harvest user login credentials through fraudulent login portals. Analysis confirms this domain impersonates AT&T/Bellsouth services, presenting a high-risk threat to users attempting to access legitimate telecommunications accounts. The domain is currently offline, but prior activity indicates active malicious use. Infrastructure analysis reveals the domain was flagged by 19 of 95 security vendors on VirusTotal, with additional detections on one security blocklist. Registered through Webflow on March 07, 2026, the domain resolved to IP address 172.64.151.8, hosted on Cloudflare's network (AS13335). The SSL certificate was issued by Google Trust Services (WE1), a common pattern observed in phishing infrastructure to lend false legitimacy. The page title, 'Bellsouth Att Signing,' directly mimics the branding of AT&T's Bellsouth services, increasing the likelihood of successful deception. Current status indicates the domain has been taken offline, likely due to detection and mitigation efforts. However, the infrastructure remains a potential risk for future malicious campaigns. Organizations and users are advised to block the domain and associated IP (172.64.151.8) at the network level. Security teams should monitor for similar domains registered through Webflow or utilizing Cloudflare-hosted infrastructure, particularly those impersonating telecommunications providers. End-users should verify the authenticity of login portals by cross-referencing URLs with official AT&T/Bellsouth domains and enabling multi-factor authentication to mitigate credential theft risks.