bellsouth-att-sign-in-08cc0f[.]webflow[.]io

Analysis of bellsouth-att-sign-in-08cc0f.webflow.io confirms its classification as a credential phishing domain targeting AT&T users, now offline as of July 25, 2026. The domain, hosted on Cloudflare infrastructure (IP 104.18.36.248, AS13335), was flagged by 14 of 95 security vendors in VirusTotal scans and appears on the PhishDestroy blocklist. Google Safe Browsing classified the site as social engineering, while Scamadviser assigned a trust score of 1/100. The SSL certificate, issued by Google Trust Services (WE1), remains valid, though the domain currently returns an HTTP 404 status with a 'Page not found' title, indicating takedown or abandonment.

Infrastructure analysis reveals Cloudflare nameservers (journey.ns.cloudflare.com, lamar.ns.cloudflare.com) and HTTP/3 protocol usage, consistent with modern phishing campaigns leveraging CDN services to evade detection. The domain was registered through MarkMonitor, Inc. on May 8, 2013, though this date predates typical phishing domain lifecycles and may reflect repurposing of an older, dormant domain. No evidence links this domain to a specific phishing kit or additional brand impersonation beyond the AT&T targeting indicated in the scam type.

Defenders should treat this domain as high-risk for credential theft, particularly for users of AT&T services. While currently offline, the domain's infrastructure remains intact, and monitoring for reactivation is recommended. Indicators such as the Cloudflare hosting, SSL certificate issuer, and blocklist presence should be incorporated into detection rules for related threats.