sbcglobal-att-signing-506a15[.]webflow[.]io

The domain sbcglobal-att-signing-506a15.webflow.io has been identified as a credential phishing threat. This domain was designed to impersonate and potentially harvest user credentials by masquerading as a legitimate service related to the well-known brand SBCGlobal and AT&T. Although no specific drainer kit has been identified, the domain's structure suggests its use in credential theft operations.

Technical indicators confirm the risk associated with this domain. It was registered through MarkMonitor, Inc. and resolves to an IP address associated with AS13335, which is managed by Cloudflare, Inc. in the United States. Notable technical details include a VirusTotal detection score of 19 out of 95 security vendors, and the domain is listed on one security blocklist, specifically flagged by PhishDestroy. The domain's SSL certificate is issued by Google Trust Services / WE1. The domain was created on February 27, 2026, which may suggest future use or erroneous data entry.

Currently, the domain is offline, and access attempts result in a '404 - Page not found' error. Despite being taken down, the risk remains elevated due to its previous activity and detection by multiple security vendors. It is crucial for users to remain cautious of similar domains, monitor for phishing attempts, and verify the authenticity of URLs before entering credentials. Organizations should continue to update their security measures and educate users about potential phishing threats to mitigate risks effectively. The involvement of 19 security vendors underscores the need for vigilance and proactive cybersecurity measures.