attonlinesit001[.]webflow[.]io

The domain attonlinesit001.webflow.io was registered on May 08, 2013 and is listed as being managed by MarkMonitor, Inc., a registrar commonly used by legitimate enterprises. The site presents a page title identical to the domain name, "attonlinesit001," and serves an SSL certificate issued by Google Trust Services under the WE1 designation, indicating the use of a valid TLS chain. DNS resolution points to the Cloudflare edge address 172.64.151.8, which is associated with AS13335 Cloudflare, Inc., and the infrastructure reports support for HTTP/3. Nameserver records show journey.ns.cloudflare.com and lamar.ns.cloudflare.com, confirming the Cloudflare front‑end.

Security telemetry shows the domain is currently offline, returning an HTTP 404 status, and has been taken down by the PhishDestroy takedown service. Despite the offline state, the domain appears on one public security blocklist and has been flagged by 15 of 95 VirusTotal scanners, reinforcing a malicious classification. The Scamadviser trust score of 1 / 100 further reflects a high likelihood of abuse. The domain explicitly impersonates the AT&T brand, aligning with a brand‑impersonation threat profile.

Uncertainty remains regarding the exact payload or credential‑collection mechanisms that may have been hosted before takedown, as no page content beyond the title has been captured. Defenders should ensure that outbound traffic to the IP 172.64.151.8 is blocked at the perimeter, update URL filtering policies to include this fully qualified domain name, and monitor for any sub‑domains or similar Cloudflare‑hosted assets that reference AT&T. Continued observation of related blocklist entries and periodic re‑scans of the domain are recommended to detect any re‑activation attempts. Incident response teams should advise users to verify any unsolicited communications claiming to originate from AT&T and to report suspicious URLs to the organization’s security portal.