bellsouth-att-sign-in-904158[.]webflow[.]io

The domain bellsouth-att-sign-in-904158.webflow.io is assessed as a high-risk generic phishing endpoint configured for brand impersonation of a telecommunications sign-in portal. The observed structure indicates a fake authentication landing page intended to harvest user credentials through deceptive login prompts and brand association.

Technical telemetry indicates VirusTotal detection by 21/95 security vendors. The domain was registered through NameCheap, Inc. and resolves to IP 104.18.36.248 located in the United States under AS13335 Cloudflare, Inc. The domain was created on February 21, 2026. Google Safe Browsing flags the domain as phishing. It is associated with SSL issuance from Google Trust Services / WE1. The domain appears on 1 security blocklist, and no additional infrastructure reuse indicators are provided beyond CDN-hosted delivery.

At the time of analysis, the domain status is recorded as offline and content resolves to a 404 page not found, indicating active takedown or hosting removal. Despite current inactivity, prior detections and early lifecycle registration suggest likely short-lived phishing deployment typical of credential harvesting campaigns. Recommended mitigation includes continued monitoring of Webflow subdomains, blocking of associated IP 104.18.36.248 where feasible, and alerting on newly registered domains containing sign-in impersonation patterns.