signin-att-bellsouth-4473f2[.]webflow[.]io

The domain signin-att-bellsouth-4473f2.webflow.io is identified as a credential phishing site designed to impersonate AT&T’s login portal. Analysis indicates the page was actively harvesting user credentials by mimicking the telecommunications provider’s authentication interface. The domain is currently offline, but prior activity suggests it targeted customers of the impersonated brand. Infrastructure analysis reveals the domain was registered on March 04, 2026, through Webflow, a legitimate website builder platform often abused for phishing campaigns. It resolved to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335), a common obfuscation tactic to evade detection. The domain was flagged by 20 of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly categorizing it as phishing. It appeared on one security blocklist and was blocked by at least one threat intelligence feed. The SSL certificate, issued by Google Trust Services (WE1), further masked malicious intent by providing a false sense of legitimacy. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations are advised to monitor network logs for connections to 104.18.36.248 and the domain name, particularly from systems that may have accessed it during its active period. Users should reset credentials if login attempts were made on this site. Security teams are recommended to update blocklists with the domain and IP, and to review Webflow-hosted subdomains for similar patterns. Proactive monitoring of newly registered domains impersonating telecommunications providers is advised to mitigate future threats.