sign-in-2047e4[.]webflow[.]io

The domain sign-in-2047e4.webflow.io is currently classified as an active generic phishing resource with an elevated risk rating. Analysis indicates that 11 of 91 security vendors on VirusTotal have flagged the domain, demonstrating a moderate consensus of malicious intent across multiple detection engines. The site is also listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, reinforcing the view that it is being used for credential harvesting operations.

No additional public intelligence—such as Safe Browsing verdicts, Open Threat Exchange reports, registrar details, IP or hosting attribution, SSL certificate information, HTTP response codes, trust scores, or page title metadata—has been published for this domain at the time of reporting. Consequently, the exact hosting environment, TLS configuration, and the specific brand or service being spoofed remain undefined. Defenders should prioritize adding sign-in-2047e4.webflow.io to network and endpoint blocklists, enforce DNS sinkholing where feasible, and monitor outbound traffic for connections to the host.

Continuous re‑evaluation is advised, as further forensic evidence may emerge that clarifies the phishing kit employed, the targeted user base, or any associated command‑and‑control infrastructure. Organizations are encouraged to instruct users to avoid unsolicited login prompts referencing the domain and to employ multi‑factor authentication to mitigate credential compromise risk. The elevated risk status warrants inclusion in threat‑intel feeds and automated response playbooks pending additional context.