l0ginxupdatexauth62v7uwiu89289980911111[.]webflow[.]io

Analysis of l0ginxupdatexauth62v7uwiu89289980911111.webflow.io indicates active credential phishing infrastructure. The domain resolves to IP address 104.18.36.248 and remains reachable as of the assessment date. VirusTotal records show that 12 out of 91 security vendors have flagged the domain, suggesting malicious behavior that has attracted partial detection. Registration was performed through the Webflow platform, and the authoritative name server information is absent (NS_NOT_FOUND), which limits visibility into DNS delegation and may hinder rapid takedown actions. The high risk rating aligns with the credential phishing classification, implying that the site is likely used to harvest login credentials or other sensitive data. While the available data confirms the domain’s activity and partial detection, the lack of detailed page content, payload samples, or observed phishing campaigns leaves the exact targeting vector unclear. Defenders should block any outbound or inbound traffic to and from the listed IP address, monitor DNS queries for the domain, and enforce strict credential verification controls for users who may encounter login prompts associated with the domain. Continuous re‑evaluation is recommended to capture any changes in detection status or additional intelligence that may emerge.