account-att-com-9161be.webflow.io
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of account-att-com-9161be.webflow.io
This domain appears to be a page hosted on Webflow rather than an official AT&T-owned domain. The subdomain string "account-att-com-9161be" and the page title "account.att.com" suggest it is attempting to resemble an AT&T account login page, while the visible content includes AT&T and BellSouth branding and a username/password form.
Based on the screenshot, the page may be presenting itself as a telecommunications account sign-in portal. However, it is served from a third-party site-building platform under webflow.io instead of an expected corporate domain, and the page layout mixes a login form with generic BellSouth informational text. That combination may indicate an imitation login page rather than a standard customer portal operated by the brand it references.
Safety Assessment for account-att-com-9161be.webflow.io
Multiple security signals indicate elevated risk at the time of this scan. The domain was flagged by 10 out of 91 security engines, with detections broadly classifying it as phishing or malicious. In addition, the page visually resembles an AT&T login experience while using a Webflow subdomain instead of an official AT&T web address, which may indicate a look-alike page intended to collect account credentials.
The malware scan did not identify malicious files, and several major threat databases were clean at the time of review. However, a clean file scan does not rule out credential-harvesting pages, which often rely on simple web forms rather than downloadable malware. The domain's IP address was also listed on one mail-reputation blocklist, which is a weaker signal on its own but still worth noting.
Given the combination of multi-engine phishing detections, brand-style login impersonation, and the mismatch between the displayed identity and the actual hosting domain, this website may pose potential risks to visitors.
Technical Description
The site uses a valid SSL certificate issued by Google Trust Services and is served through Cloudflare infrastructure at IP address 172.64.151.8, with hosting geolocated to Toronto, Canada. HTTPS availability indicates encrypted transport, but encryption alone does not verify that the page is legitimately operated by the brand it references.
The page appears to be built on Webflow and loads assets from website-files.com, CloudFront, and a Cloudflare Turnstile script. DNSSEC status, registrar, protocol details, and nameserver information were not available in the scan data. A notable technical concern is the use of a third-party hosted subdomain to mimic a branded account-login experience, which is commonly associated with phishing campaigns.
Share your experience with this website. Was it safe? Did you encounter any issues?