bellsouth-att-sign-in-4b8c33[.]webflow[.]io

The domain bellsouth-att-sign-in-4b8c33.webflow.io is flagged by 21 out of 95 vendors on VirusTotal, indicating a significant threat level. It impersonates AT&T, aiming to deceive users into providing sensitive information. The site is now offline but was previously active and hosted by Cloudflare, Inc. in the US.

This phishing domain uses a convincing page title 'bellsouth att sign in' to lure AT&T customers. It exploits the trust associated with the AT&T brand, attempting to harvest login credentials or other personal data. The domain's SSL certificate is issued by Google Trust Services, adding a layer of perceived legitimacy to the scam.

Despite being taken down, the domain's impact is evident through its presence on public blocklists such as PhishDestroy and PhishingDB. Google Safe Browsing has also flagged it, further confirming its malicious intent. The domain's registrar, MarkMonitor, Inc., is a well-known entity, often used by legitimate brands, which adds to the deceptive nature of this operation. This case underscores the importance of early detection systems in identifying and mitigating phishing threats before they propagate through antivirus databases.