sbcglobal-att-signing-b5d5e6[.]webflow[.]io

This domain is flagged as a high-risk credential theft operation designed to harvest user login credentials by impersonating AT&T’s SBCGlobal email service. Analysis indicates the site employs realistic branding and login prompts to deceive victims into submitting sensitive account details, which are then exfiltrated to attacker-controlled infrastructure. The threat is classified as active and continues to pose significant risk to individuals and organizations relying on AT&T’s email services. Infrastructure analysis reveals the following technical indicators: the domain sbcglobal-att-signing-b5d5e6.webflow.io is hosted on Webflow’s platform and resolves to IP address 104.18.36.248, geolocated to California under Cloudflare’s network. The SSL certificate is issued by Google Trust Services (WE1), a common obfuscation tactic to lend legitimacy. VirusTotal reports 18 out of 95 security vendors detecting the domain as malicious, while it appears on at least one security blocklist. Google Safe Browsing has also classified the site as phishing. The page title, 'Sbcglobal Att Signing,' directly mimics AT&T’s legitimate login portal, reinforcing the brand impersonation strategy. Mitigation requires immediate action to prevent credential compromise. Network administrators should block the domain and its resolving IP (104.18.36.248) at the firewall or DNS level. End users who may have interacted with the site should reset their AT&T account passwords via the official portal and enable multi-factor authentication. Organizations should conduct internal audits for unauthorized access attempts linked to this domain. Security teams are advised to monitor for additional Webflow-hosted subdomains using similar naming conventions, as this infrastructure may be reused for further phishing campaigns.