bellsouth-att-signing-1dd6db[.]webflow[.]io

PhishDestroy identifies the domain bellsouth-att-signing-1dd6db.webflow.io as a live credential theft operation impersonating AT&T. The page leverages a fake authentication flow to trick users into submitting sensitive login credentials, making this a high-risk brand impersonation attack. The infrastructure relies on Webflow hosting, which has been abused to host phishing content due to its legitimate appearance. This domain was flagged by 14 out of 95 VirusTotal security vendors, indicating widespread detection. It resolves to IP 104.18.36.248, uses a Google Trust Services SSL certificate, and is listed by Google Safe Browsing under SOCIAL_ENGINEERING. The domain was registered recently and hosted on Webflow’s platform, which has become a common vector for low-effort but convincing phishing pages. The site remains active and poses a significant risk to AT&T customers. Users should avoid interacting with this domain and report it to their security teams. Immediate blocking at the network level is recommended. While the SSL certificate adds superficial legitimacy, the combination of low VT detection, Google flagging, and active deployment signals a persistent threat requiring urgent mitigation.