sbcverification[.]webflow[.]io

sbcverification.webflow.io is a subdomain of webflow.io. PhishDestroy first recorded this hostname on Jul 17, 2026. Stored content metadata identifies Att as the apparent target. The assembled evidence scores 100/100 (critical).

Four independent sources are positive: VirusTotal, Google Safe Browsing, Cloudflare Radar, and URLScan. On Jul 17, 2026 at 01:50 UTC, VirusTotal recorded 17 detections among 91 engines: alphaMountain.ai, BitDefender, ESET, Emsisoft, Fortinet, G-Data, Google Safe Browsing, Gridinsoft, Kaspersky, LevelBlue, Lionic, Netcraft, OpenPhish, Phishtank, Sophos, VIPRE, Webroot; Google Safe Browsing flagged the domain: Social Engineering. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. URLScan returned a malicious verdict with score 100 on Jul 17, 2026 at 01:45 UTC. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC.

HTTP 404 was recorded on Aug 7, 2026 at 01:06 UTC; content was unavailable. Registration records for the registrable domain webflow.io list Webflow as the registrar. At collection time, the hostname resolved to 172.64.151.8 on AS13335 (Cloudflare, Inc.). The recorded endpoint location is Toronto, CA. The stored server header is cloudflare. Captured page title: “sbcverification”. DOM analysis completed on Jul 17, 2026 at 02:20 UTC; stored DOM score 100/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Jul 29, 2026 at 02:47 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists Google Trust Services / WE1 as the certificate issuer with validity through Aug 25, 2026; checked Jul 17, 2026 at 04:00 UTC.

Taken together, the page content and independent findings support classifying this hostname as Att impersonation and phishing. The stored record does not establish the post-click interaction, and it does not claim a confirmed wallet-draining transaction or credential submission.