walrusfi-com[.]webflow[.]io

The domain walrusfi-com.webflow.io is currently listed as an active high‑risk generic phishing site. It returns HTTP 200 responses and presents a valid SSL certificate issued by Google Trust Services under the WE1 root, indicating that the site is served over HTTPS. Infrastructure analysis shows the site is hosted on Cloudflare’s network (AS13335) and resolves to the IP address 172.64.151.8, which is located in the United States. The authoritative nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The page loads external libraries from Webflow, jsDelivr, jQuery and Google Analytics, and supports HTTP/3, confirming the presence of modern web stack components. Reputation data reveal that only two of ninety‑five security vendors on VirusTotal have flagged the domain, while Gridinsoft assigns a trust score of zero out of one hundred, reflecting a very low confidence in its legitimacy. The domain is listed on one security blocklist and has been actively blocked by PhishDestroy. Registration was performed through MarkMonitor, Inc. on May 08 2013, suggesting the registration date predates the observed malicious activity. The only publicly observable content is the page title “Walrus Security | Know Who You’re Paying,” which implies a credential‑harvesting campaign aimed at financial transactions. No additional forensic detail about the phishing kit, form fields, or payloads is available from the current dataset, leaving the exact method of data collection uncertain. Defenders should add walrusfi-com.webflow.io to DNS‑based blocklists and configure web‑filtering solutions to deny HTTP and HTTPS traffic to the domain. Monitoring of Cloudflare‑served IP ranges for similar activity and updating intrusion‑detection signatures with the observed certificate issuer and technology stack are recommended. Continuous re‑evaluation is advised in case the site’s content evolves.