bellsouth-att-sign-in-81225f[.]webflow[.]io

This domain, bellsouth-att-sign-in-81225f.webflow.io, is a confirmed credential theft operation impersonating AT&T's Bellsouth login portal. Analysis indicates the site was designed to harvest user credentials by mimicking the authentic AT&T sign-in interface, specifically targeting customers of the telecommunications provider. The page title, 'bellsouth att sign in,' directly aligns with AT&T's branding, increasing the likelihood of successful deception among unsuspecting users. No evidence of a crypto drainer kit or secondary payloads was observed, focusing the threat solely on credential acquisition. Technical indicators confirm the domain's malicious nature. The site is flagged by 18 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly marking it as phishing. Infrastructure analysis reveals the domain was registered through NameCheap, Inc. on February 21, 2026, an anomalous future date suggesting potential obfuscation or system error. It resolves to IP address 104.18.36.248, hosted on Cloudflare's network (AS13335), a common tactic to obscure origin and evade takedowns. The domain appears on one security blocklist and uses an SSL certificate issued by Google Trust Services (WE1), which may lend a false sense of legitimacy to victims. The creation date discrepancy and Cloudflare hosting further indicate attempts to prolong the campaign's operational lifespan. The domain is currently offline, likely following detection and takedown efforts by security providers. However, residual risk persists due to the potential reuse of infrastructure or registration of similar domains. Organizations and users are advised to block the domain and IP address at the network level, monitor for credential reuse attempts, and implement multi-factor authentication (MFA) to mitigate account compromise risks. Given the AT&T branding, affected users should be alerted to reset passwords and review account activity for unauthorized access. The anomalous registration date warrants further investigation into potential registrar abuse or automated domain generation tactics.