www-att-net-ed98ac[.]webflow[.]io

The domain www-att-net-ed98ac.webflow.io was flagged as a high‑risk generic phishing indicator and is currently taken offline. Infrastructure analysis shows the hostname resolves to 172.64.151.8, an address owned by Cloudflare (AS13335) and located in the United States. The domain uses Cloudflare’s DNS service, with authoritative name servers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and supports HTTP/3. An SSL certificate issued by Google Trust Services under the WE1 identifier secures the site, indicating the connection was encrypted at the time of observation.

The page title returned from the server is "www.att.net," matching the target brand name, though no further content has been captured. The domain was registered through MarkMonitor, Inc. on May 08, 2013, and the Gridinsoft trust score is recorded as 0 out of 100, suggesting an extremely low reputation. Google Safe Browsing classifies the URL as social engineering, and the site appears on one security blocklist. VirusTotal reports that 17 of 91 scanned security vendors flagged the domain, reinforcing the malicious assessment.

PhishDestroy has also blocked the domain. Because the site is offline, active payloads cannot be verified, but the combination of a spoofed brand title, low trust score, multiple vendor detections, and blocklist entries provides strong evidence of phishing intent. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurrection attempts, and consider adding the IP address to threat‑intel feeds. Further analysis is limited by the lack of live content, so ongoing surveillance is recommended to capture any future re‑hosting activity.