sso-coinsquarre-com-cdn-auth[.]webflow[.]io

Analysis of the domain sso-coinsquarre-com-cdn-auth.webflow.io, observed on 24 July 2026, indicates active generic phishing infrastructure. The domain resolves to the IP address 104.18.36.248, which is hosted by Webflow, Inc., a legitimate website‑building service. Despite the benign hosting provider, the domain appears on two independent phishing blocklists—PhishDestroy and OpenPhish—and Google Safe Browsing classifies it as a social‑engineering threat. VirusTotal reports that 15 of 91 scanning engines have generated detections for this host, reinforcing the malicious assessment. Registration metadata shows the domain was created through Webflow’s registrar services; however, the authoritative nameserver information could not be retrieved (NS_NOT_FOUND). The domain remains active at the time of analysis.

The convergence of multiple independent detection sources, a high‑confidence safe‑browsing flag, and a non‑trivial VirusTotal detection count suggests the site is being used to harvest credentials or otherwise deceive users. The presence on two curated blocklists demonstrates that at least two independent security teams have identified malicious activity associated with the host. Google Safe Browsing’s social‑engineering label indicates the site likely attempts to trick users into divulging credentials, though the specific target brand is not disclosed. The 15 detections reported by VirusTotal span a mix of antivirus and URL scanners, providing additional confidence that the domain hosts or redirects to malicious content.

Because the domain is hosted on Webflow’s infrastructure, traditional hosting‑abuse takedown mechanisms may be less effective, requiring coordination with the platform’s abuse team. The lack of publicly available page title, SSL certificate details, or HTTP response codes limits a more granular assessment of the payload delivered to victims.