sign-in-66e8c0[.]webflow[.]io

The domain sign-in-66e8c0.webflow.io is currently classified as an active generic phishing infrastructure with an elevated risk rating. VirusTotal assessments show that 16 of 91 security vendors have flagged the domain, indicating a moderate level of consensus among detection engines. The domain resolves to the IPv4 address 172.64.151.8, which is hosted on a shared service provider network and does not appear to be dedicated to a single malicious actor.

It is listed on two independent security blocklists and has been explicitly blocked by PhishDestroy and OpenPhish, confirming that multiple threat‑intelligence feeds treat the host as malicious. No additional context such as registrar details, SSL certificate metadata, HTTP response codes, page titles, or Safe Browsing verdicts is available in the current intelligence set, leaving the precise phishing campaign payload and targeted brand unconfirmed. Defenders should prioritize blocking DNS resolution to 172.64.151.8 across network perimeter controls and incorporate the domain into existing URL filtering policies.

Continuous monitoring of the domain’s detection status on VirusTotal and the two blocklists is advised, as further vendor detections may surface. Incident response teams should treat any network traffic to or from this domain as malicious, isolate affected hosts, and conduct forensic analysis to identify potential credential harvesting or credential reuse attempts. Organizations using threat‑intelligence platforms should update IoC feeds with the domain and associated IP to ensure downstream security tools receive timely alerts.