birttmertlogin[.]webflow[.]io

PhishDestroy identifies birttmertlogin.webflow.io as an active credential-phishing domain designed to trick users into surrendering login credentials. This site mimics legitimate login interfaces to harvest usernames and passwords, then redirects stolen data to attacker-controlled servers. The threat is elevated because once credentials are captured, attackers can access email, banking, or corporate accounts, leading to identity theft or financial fraud. Users who enter their details risk immediate account compromise and prolonged recovery challenges. This domain was flagged by 12 out of 95 VirusTotal security vendors and resolves to IP 172.64.151.8. The SSL certificate is issued by Google Trust Services, which may give a false sense of legitimacy. While the creation date and registrar are not specified in the available intelligence, the combination of low detection by only 12.6% of scanners and active phishing content indicates a recently deployed threat with high evasion potential. If you visited birttmertlogin.webflow.io, assume your credentials may have been compromised. Immediately change passwords on any account where you reused this login. Enable multi-factor authentication (MFA) where available. Scan your devices for malware and avoid clicking suspicious links. Report the domain to your security team or through platforms like Google Safe Browsing to help block further abuse.