bellsouth-att-signing-b613f6[.]webflow[.]io

Analysis of bellsouth-att-signing-b613f6.webflow.io indicates a high‑risk brand‑impersonation campaign targeting AT&T customers. The domain was created on 08 May 2013 and is registered through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises, which may be an attempt to lend credibility. DNS resolution points to 104.18.36.248, an address owned by Cloudflare (AS13335) and the domain’s authoritative nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com. HTTP traffic is served over Cloudflare’s network with support for HTTP/3, and the TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint despite the malicious intent.

A request to the site returns a 404 status code, and the page title observed is “Bellsouth Att Signing”, which contains no direct reference to AT&T but aligns with the reported impersonation vector. Reputation signals are strongly negative: Scamadviser assigns a trust score of 1 / 100, and Google Safe Browsing flags the URL for social‑engineering content. VirusTotal reports that 19 of 95 scanned security vendors flag the domain as malicious, and the site appears on a single known blocklist, PhishDestroy. The combination of a low trust score, multiple vendor detections, and a Google Safe Browsing alert supports a classification of confirmed phishing or credential‑harvesting activity, even though the site is currently offline.

Uncertainty remains regarding the exact payload or credential‑capture mechanism because the site returns only a 404 response and no page content has been captured. Defenders should continue to block the domain at network perimeter devices, update DNS sinkhole entries, and monitor for any resurgence of the host. Additional investigation of related subdomains or future re‑registration attempts is advisable, as the underlying Cloudflare infrastructure could be reused for new impersonation campaigns.