nexus-97b829[.]webflow[.]io

This domain is flagged as a generic phishing site specializing in credential harvesting, currently assessed at an elevated risk level. Analysis indicates the infrastructure was designed to mimic legitimate authentication portals, likely targeting corporate or financial sector users through deceptive login interfaces. The domain has since been taken offline, but prior activity warrants scrutiny due to its technical indicators and detection history. Infrastructure analysis reveals the domain nexus-97b829.webflow.io was hosted on IP address 104.18.36.248, utilizing Cloudflare's content delivery network. The site was registered through MarkMonitor, Inc. on May 08, 2013, though the phishing content appears to be a more recent deployment. Security vendors on VirusTotal flagged the domain at a 2/95 detection rate, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist, specifically PhishDestroy, and employed technologies including jsDelivr, jQuery CDN, and HTTP/3 for enhanced performance and obfuscation. The SSL certificate was issued by Google Trust Services, providing a false sense of legitimacy to potential victims. Mitigation against credential harvesting phishing sites requires multi-layered defenses. Organizations should implement email filtering rules to block messages containing known phishing domains or suspicious links, particularly those hosted on content delivery networks. Endpoint protection should be configured to detect and prevent access to domains with low trust scores or recent creation dates, even if they possess valid SSL certificates. User training must emphasize verification of domain authenticity before entering credentials, focusing on subtle indicators such as mismatched URLs or unexpected certificate authorities. Network monitoring should include alerts for connections to IPs associated with known phishing infrastructure, such as 104.18.36.248, and blocklists should be updated in real-time to reflect emerging threats. Post-incident response should include forced password resets for any accounts potentially exposed to the phishing domain and analysis of authentication logs for suspicious access patterns.