sbc-verifier-sign-in-fc701d[.]webflow[.]io

The domain sbc-verifier-sign-in-fc701d.webflow.io operates as a phishing infrastructure designed to impersonate AT&T's authentication portals. This high-risk threat specifically targets user credentials through fraudulent sign-in pages, though the current page title displays a 404 error, suggesting either temporary takedown or evasion tactics. Analysis indicates this domain was actively used for credential harvesting prior to being flagged. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc. and resolves to IP address 104.18.36.248, hosted on Cloudflare's network (AS13335). The domain was created on March 04, 2026, though this future date suggests possible falsification of registration records. Security vendors have flagged this domain as malicious, with 19 of 95 VirusTotal engines detecting it as phishing infrastructure. The domain appears on one security blocklist and is explicitly classified as phishing by Google Safe Browsing. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious Cloudflare-hosted sites. Current status shows the domain as offline, though this may represent temporary deactivation rather than permanent remediation. The 404 page title indicates either server misconfiguration or deliberate concealment of malicious content. Organizations should treat this domain as compromised infrastructure and implement immediate protective measures. Network administrators are advised to block the domain and associated IP address 104.18.36.248 at perimeter defenses. Security teams should search logs for connections to this domain and investigate potential credential exposure. Users who may have interacted with this domain should be directed to reset their credentials through official AT&T channels and enable multi-factor authentication where available.