bellsouth-att-sign-in-d139da[.]webflow[.]io

The domain bellsouth-att-sign-in-d139da.webflow.io has been identified as a high-risk phishing infrastructure specifically designed to impersonate AT&T login portals. This domain falls under the threat category of credential harvesting phishing, targeting users of the telecommunications service. As of the latest verification, the domain has been taken offline, though prior activity remains a documented security concern. Analysis indicates the domain was flagged by 18 of 95 security vendors on VirusTotal, reflecting broad detection across multiple threat intelligence platforms. Infrastructure examination reveals the domain was registered through MarkMonitor, Inc. on May 8, 2013, and resolves to the IP address 104.18.36.248, hosted on Cloudflare’s AS13335 network in the United States. The SSL certificate is issued by Google Trust Services under the WE1 intermediate. The domain appears on two distinct security blocklists and was actively blocked by PhishDestroy and PhishingDB prior to its takedown. Despite the current 404 response, historical data confirms its use in phishing operations. Current status confirms the domain is offline, though residual risk remains due to its prior malicious activity. Organizations and end users are advised to implement strict filtering rules blocking both the domain and its associated IP address. Security teams should monitor for similar patterns, including subdomains under webflow.io or other content delivery platforms, and verify SSL certificates against known legitimate issuers. Credential reset protocols are recommended for any users who may have interacted with the domain prior to its deactivation.