# PhishDestroy domain threat record: teletechdigital.webflow.io Content language: English Canonical HTML report: https://phishdestroy.io/domain/teletechdigital.webflow.io/ Machine-readable companion: https://phishdestroy.io/domain/teletechdigital.webflow.io/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-15 04:40:08 UTC - Last availability or vendor check: 2026-10-21 01:16:20 UTC - Stored record updated: 2026-10-22 14:24:34 UTC - VirusTotal detections in the stored snapshot: 12/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 104.18.36.248 - Registrar in stored WHOIS data: MarkMonitor Inc. - Last stored HTTP status: 404 - Registration date (registry RDAP, webflow.io): 2013-05-08 02:20:57 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/teletechdigital.webflow.io - Certificate Transparency search: https://crt.sh/?q=%25.teletechdigital.webflow.io - Web Archive lookup: https://web.archive.org/web/*/https://teletechdigital.webflow.io/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview teletechdigital.webflow.io is an impersonation phishing page built on a free Webflow site-builder subdomain. It poses as a legitimate business to win the trust of people who land on it. PhishDestroy first flagged it on 2026-09-15. The site has been offline since 2026-09-21, and it still served nothing at its root when last checked on 2026-10-19. How the scam works Impersonation pages copy the look and name of a real company so visitors believe they are dealing with that company. They then ask for logins, contact details, payment information or a follow-up conversation that leads to fraud. Webflow subdomains are attractive for this because they cost nothing, go live in minutes and inherit the reputation of a well-known hosting platform. The page currently shows the title "404 - Page not found", while our classification is based on the impersonation content it carried while active. Evidence When checked on 2026-09-23, 12 of 89 VirusTotal engines flagged the address as malicious. The engines that flagged it include BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, G-Data, Lionic, LevelBlue and alphaMountain.ai. That is a modest share of engines, but it comes from several established security vendors acting independently of each other, which supports our verdict. PhishDestroy lists the domain on its own blocklist. Infrastructure The page sat on a subdomain of a shared website-building service rather than on a registered domain. This setup lets an operator skip registration entirely and discard the site once it is reported. Traffic was served through Cloudflare, Inc. at an address geolocated to Canada. The page lasted only about six days after PhishDestroy first detected it before going offline, which is typical of throwaway impersonation pages. What to do If you entered a password on this page, change it right away on the genuine service and anywhere else you reuse it. Then turn on two-factor authentication. If you shared card or bank details, contact your bank to block the card and watch your statements. Treat any follow-up email, call or message that references this site as part of the same scam. Defenders should block the subdomain, search mail and proxy logs for visits since 2026-09-15, and report any similar Webflow-hosted lookalikes to the platform for takedown. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/teletechdigital.webflow.io Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=teletechdigital.webflow.io Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:18:31 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/2dc93792-8ae7-4f69-a9a9-7c85d2670661.png Captured: 2026-09-21 12:57:20 UTC Source report: https://radar.cloudflare.com/scan/2dc93792-8ae7-4f69-a9a9-7c85d2670661 SHA-256: a380e448eb3101674f4c67f891f37ba29b76e79d0bcca3163d4b1510d947431b - URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a25d-153c-70aa-844c-361738670850.png Captured: 2026-09-15 00:00:13 UTC Source report: https://urlscan.io/result/01a0a25d-153c-70aa-844c-361738670850/ SHA-256: fa898a76819dbf2d4a36572f25fe910e502c998f78b40e9f5329ecd3e95f87ae - URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a25d-193b-70b6-ad1d-3130265c8b61.png Captured: 2026-09-15 00:00:13 UTC Source report: https://urlscan.io/result/01a0a25d-193b-70b6-ad1d-3130265c8b61/ SHA-256: fa898a76819dbf2d4a36572f25fe910e502c998f78b40e9f5329ecd3e95f87ae - URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c23c-c6bf-7261-9668-700382cce276.png Captured: 2026-09-21 04:32:44 UTC Source report: https://urlscan.io/result/01a0c23c-c6bf-7261-9668-700382cce276/ SHA-256: 7cedf6b239a8ccfbf04efbca4710b3acf935b40010b565d35ffb71ee80df3058 - URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c23c-c607-745f-8f3c-fdf03ded7495.png Captured: 2026-09-21 04:32:46 UTC Source report: https://urlscan.io/result/01a0c23c-c607-745f-8f3c-fdf03ded7495/ SHA-256: 962d9b008c24974ac8ab07b7680a01b3be95a4009018c7bd0fb6b74f91b391f1 - URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cbf3-54ce-7677-9637-6d284796e70b.png Captured: 2026-09-23 01:48:43 UTC Source report: https://urlscan.io/result/01a0cbf3-54ce-7677-9637-6d284796e70b/ SHA-256: 962d9b008c24974ac8ab07b7680a01b3be95a4009018c7bd0fb6b74f91b391f1 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:30:34Z", "uuid": "2dc93792-8ae7-4f69-a9a9-7c85d2670661", "scanned_at": "2026-09-21T12:57:20Z", "final_url": "https://teletechdigital.webflow.io/", "status": 404, "history": [ { "url": "https://teletechdigital.webflow.io/", "status": 404 } ], "dom_hash": "4932075438459d054af6b75a0d6585b123ae775f36579c095159b2af33360488", "doc_hash": "90c032f35272ba1a7aa93027ab635e6610d4f24cf9e53c0624d00f065d7c7e7d", "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "teletechdigital.webflow.io", "type": "A", "value": "104.18.36.248" }, { "name": "teletechdigital.webflow.io", "type": "A", "value": "172.64.151.8" }, { "name": "teletechdigital.webflow.io", "type": "AAAA", "value": "2a06:98c1:3102::ac40:9708" }, { "name": "teletechdigital.webflow.io", "type": "AAAA", "value": "2a06:98c1:3105::6812:24f8" } ], "dnssec_valid": false, "ip": "104.18.36.248", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "MarkMonitor Inc.", "created": "2013-05-08T02:20:57Z", "updated": "2026-08-12T04:04:30Z", "expires": "2028-05-08T02:20:57Z", "nameservers": [ "lamar.ns.cloudflare.com", "journey.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T01:53:04Z", "analysis_at": "2026-10-13T09:38:10Z", "stats": { "timeout": 0, "harmless": 46, "malicious": 13, "suspicious": 0, "undetected": 33 }, "detections": { "ESET": "phishing", "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "LevelBlue": "phishing", "Seclookup": "malicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "MarkMonitor Inc.", "created": "2013-05-08T02:20:57Z", "expires": "2028-05-08T02:20:57Z", "updated": "2026-08-12T04:04:30Z", "first_seen": "2026-09-14T23:25:55Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2a06:98c1:3102::ac40:9708" }, { "ttl": 300, "type": "AAAA", "value": "2a06:98c1:3105::6812:24f8" }, { "ttl": 300, "type": "A", "value": "172.64.151.8" }, { "ttl": 300, "type": "A", "value": "104.18.36.248" } ], "dns_at": "2026-10-13T09:44:16Z", "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "webflow.io", "*.webflow.io" ], "issuer": "Google Trust Services / WE1", "serial": "ac972ef95a18ab8f0e5a2917e958d6da", "sha256": "5302eb12d2c1ddc8020e4565aef253a59e28b4a9aede60f73e4fe6cb516fd2a7", "subject": "webflow.io", "valid_to": "2026-12-21T03:46:57Z", "valid_from": "2026-09-22T02:47:08Z" }, "whois": { "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2013-05-08T02:20:57Z", "updated": "2025-02-25T20:53:31Z", "expires": "2028-05-08T02:20:57Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "journey.ns.cloudflare.com", "lamar.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```