ledzrlognn[.]webflow[.]io

Analysis of ledzrlognn.webflow.io confirms an active phishing domain hosted on Webflow infrastructure. The domain resolves to IP address 104.18.36.248, a shared Webflow endpoint, and remains operational as of July 31, 2026. Infrastructure review reveals no assigned nameservers, an atypical configuration that may indicate rapid deployment or evasion tactics. The domain appears on one security blocklist and is flagged by seven of ninety-one security vendors in VirusTotal scans, signaling moderate detection coverage but clear malicious classification by multiple engines.

Registrar records confirm Webflow, Inc. as the hosting provider, consistent with the observed infrastructure. No SSL certificate anomalies or HTTP status errors were reported, suggesting the site is configured to appear legitimate to casual inspection. The exact content and targeted brand remain unconfirmed, as no page title, phishing kit, or brand target details were provided in available intelligence. Defenders should treat this domain as high-risk based on detection volume and active status.

Recommended actions include immediate blocking at network and endpoint levels, particularly given its presence on PhishDestroy’s blocklist. Security teams should monitor for related domains on Webflow’s platform, as the service’s ease of deployment may facilitate rapid phishing site rotation. Further analysis of the page content is advised to determine the specific scam type and potential victim impact.