webflow[.]preproduction[.]io

This domain, webflow.preproduction.io, is flagged as a generic phishing resource with a high-risk classification. Analysis indicates the domain was registered on February 21, 2026, through 1API GmbH and remains active as of July 12, 2026. The current HTTP response code is 403 Forbidden, suggesting either deliberate cloaking or misconfiguration, while the page title explicitly reads '403 Forbidden.' Infrastructure analysis reveals the domain resolves to 142.93.48.60, an IP address hosted on AS14061 (DigitalOcean, LLC) in the United States, with nameservers ns1.digitalocean.com, ns2.digitalocean.com, and ns3.digitalocean.com. Security vendor detection on VirusTotal shows 5 out of 95 engines flagging the domain, though the specific nature of the phishing content remains unconfirmed due to the 403 response. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and holds a Gridinsoft trust score of 0/100. SSL certification is provided by Let's Encrypt, and server technology is identified as Nginx. No brand target or phishing kit details are present in available data, limiting attribution beyond generic phishing classification. Defenders should treat this domain as hostile infrastructure. The 403 response may indicate evasion tactics, such as IP-based filtering or geofencing, to obstruct analysis. Network-level blocking of 142.93.48.60 and the domain itself is recommended, alongside monitoring for related subdomains or newly registered lookalike domains under the preproduction.io namespace. Given the domain's recent creation and active status, further credential-harvesting or malware distribution attempts cannot be ruled out. No visual or behavioral analysis of the phishing page is available due to the 403 response. Organizations should correlate logs for any prior connections to this domain or IP, particularly from endpoints exhibiting anomalous authentication patterns or unexpected outbound traffic to DigitalOcean-hosted resources.