bellsouth-att-sign-in-ccb981[.]webflow[.]io

The domain bellsouth-att-sign-in-ccb981.webflow.io was observed as an offline site that previously hosted content targeting AT&T customers. Infrastructure analysis shows the domain resolved to IP address 172.64.151.8, which belongs to Cloudflare, Inc. (AS13335) and is served over HTTP/3. The site was protected by a Google Trust Services certificate issued to the WE1 authority, indicating a valid TLS handshake despite the malicious purpose. DNS records point to Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, confirming the use of Cloudflare’s DNS and CDN services.

Registration data reveal the domain was created on May 08, 2013 and is managed through MarkMonitor, Inc., a registrar commonly used for brand‑related domains. The page title returned by the server was "bellsouth att sign in," aligning with the AT&T brand impersonation claim. VirusTotal scans recorded 15 detections out of 93 security vendors, and Google Safe Browsing flagged the domain for social engineering. The HTTP response was a 404 status, indicating the content was removed or the site was taken down.

The domain appears on one public security blocklist and is listed as blocked by PhishDestroy. While the site is no longer active, the combination of a legitimate‑looking TLS certificate, reputable registrar, and Cloudflare hosting suggests the operators leveraged trusted services to increase credibility. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence of the same host‑header or similar sub‑domains, and update detection signatures to include the observed page title and SSL certificate details. Incident response teams should also advise users to verify AT&T login URLs and report any attempts to use this domain to relevant brand‑protection channels.