traderjo-exyz[.]webflow[.]io

Analysis of traderjo-exyz.webflow.io, created on 23 February 2026 and hosted on Cloudflare (AS13335) with IP 172.64.151.8, shows a high‑risk generic phishing operation. The site resolves over HTTP/3 and presents a valid SSL certificate issued by Google Trust Services (WE1), which may lend it superficial legitimacy. Infrastructure inspection reveals the use of Webflow as the site builder and Cloudflare as the CDN, both common choices for malicious actors seeking rapid deployment and DDoS protection. The registrar is NameCheap, Inc., and the domain carries a Gridinsoft trust score of 0/100, indicating a lack of trustworthiness.

It is listed on three public security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL, confirming community‑wide detection. VirusTotal reports a single positive detection out of 93 scanners, further supporting the malicious classification. The HTTP response code is 200 and the page title reads “Trader Joe XYZ : Home Website,” but no additional content analysis is available, leaving the exact phishing lure unknown. Defenders should immediately add the domain and its resolving IP to deny‑list rules at perimeter firewalls, DNS resolvers, and proxy filters.

Continuous monitoring of DNS queries for the domain and related subdomains is advised, as well as threat‑intel sharing with partners. Because the underlying hosting is Cloudflare, a request for takedown via Cloudflare’s abuse channel may be effective, though the rapid provisioning capabilities of Webflow could enable quick re‑hosting. Overall, the combination of a zero trust score, blocklist presence, and a valid TLS certificate makes traderjo-exyz.webflow.io a clear high‑severity phishing threat that requires prompt mitigation.