swisborggglogin[.]webflow[.]io

Analysis conducted on July 24, 2026, identifies swisborggglogin.webflow.io as an active credential-phishing domain with high-risk indicators. The domain is hosted on Webflow, Inc. infrastructure and resolves to the IP address 172.64.151.8, which lacks associated nameserver records (NS_NOT_FOUND). This absence of authoritative DNS configuration may suggest misconfigured or obfuscated hosting, a tactic occasionally observed in phishing campaigns to evade detection or takedown efforts. VirusTotal telemetry, as of the report date, indicates that 13 out of 91 security vendors have flagged the domain as malicious. While this detection rate does not constitute unanimous consensus, it reflects a significant level of suspicion among established security providers.

Additionally, the domain appears on two independent security blocklists: PhishDestroy and OpenPhish, further corroborating its classification as a phishing threat. The domain remains operational at the time of analysis, with no evidence of remediation or suspension by the registrar or hosting provider. Infrastructure analysis reveals that the domain is registered through Webflow, a legitimate platform commonly used for website creation, which may inadvertently facilitate phishing operations due to its ease of use and low barrier to entry. The IP address 172.64.151.8 is part of a broader hosting range, but no further attribution—such as autonomous system number (ASN) or geographic location—has been provided in the available intelligence. The exact content of the phishing page, including any targeted brand or specific credential-harvesting mechanisms, has not been analyzed in this report.

Defenders are advised to treat this domain as a confirmed phishing threat and implement blocking measures at the DNS, proxy, or endpoint level. Network security teams should monitor for connections to 172.64.151.8 or swisborggglogin.webflow.io in logs and alert on any internal access attempts.