garminilgeen[.]webflow[.]io

Analysis of garminilgeen.webflow.io as of August 06, 2026 indicates the domain is actively being used for generic phishing. The domain resolves to the IP address 104.18.36.248, a host commonly associated with CDN services. No nameserver records were returned, suggesting either intentional obfuscation or misconfiguration of the DNS zone. VirusTotal reports that 12 of 91 security vendors have flagged the domain, providing independent confirmation of malicious activity.

The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy filtering service, reinforcing the view that it is considered harmful by multiple defensive platforms. Registration details show the domain was created through Webflow, Inc., a legitimate website‑building service, which is often abused to host fraudulent pages because of its ease of deployment and built‑in SSL support. The threat classification is recorded as generic phishing, and the risk level has been assigned as high. Current monitoring indicates the domain remains active, with no evidence of takedown or remediation.

Defenders should treat any traffic to or from garminilgeen.webflow.io as suspicious. Recommended mitigations include adding the domain to deny lists, enforcing outbound filtering, and monitoring for related DNS queries. Continuous re‑evaluation is advised, as the hosting provider may change the underlying IP or the domain could be repointed to new infrastructure, potentially altering its threat profile.