eithhspullyuio[.]webflow[.]io

Analysis of the domain eithhspullyuio.webflow.io indicates it was actively flagged as a generic phishing threat prior to being taken offline on or before July 25, 2026. The domain, registered through Webflow, resolved to the IP address 172.64.151.8, hosted on Cloudflare's infrastructure (AS13335) in the United States. At the time of assessment, the domain returned an HTTP 404 status with the page title '404 - Page not found,' suggesting the phishing content was either removed or relocated. Detection data from security vendors reveals that three of ninety-four engines on VirusTotal flagged the domain, while three distinct security blocklists, including PhishDestroy, MetaMask, and SEAL, had already listed it.

The SSL certificate was issued by Google Trust Services, a common feature in both legitimate and malicious sites leveraging Cloudflare's CDN. No nameservers were detected, which may indicate an incomplete or hastily configured deployment. Infrastructure analysis confirms the use of Cloudflare's network and HTTP/3 protocol, typical of modern phishing campaigns aiming to evade detection through reputable hosting providers. While the exact brand or service targeted by this phishing operation remains unconfirmed due to the absence of visible content, the domain's prior detection and blocklist inclusion justify elevated risk classification.

Defenders should treat any prior connections to this domain as potential exposure to phishing activity. Network logs should be reviewed for interactions with 172.64.151.8, and endpoint detection rules should account for Webflow-registered domains exhibiting similar patterns. Given the domain's current offline status, further forensic analysis of cached or archived content may be necessary to determine the full scope of the campaign.