category-labs-chog-molandak11[.]webflow[.]io

Analysis of category-labs-chog-molandak11.webflow.io shows an active brand‑impersonation campaign targeting LinkedIn. The site resolves to 104.18.36.248, an address owned by Cloudflare (AS13335) and is served over HTTPS with a Google Trust Services / WE1 certificate. DNS is hosted on Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. HTTP response code is 200 and the page title reads “Category Labs | We make complex systems incredibly fast.” The infrastructure uses Cloudflare, HTTP/3, and third‑party libraries from Unpkg, jsDelivr and Google Analytics. Security reputation is poor: Gridinsoft assigns a trust score of 0/100, the domain appears on one security blocklist, PhishDestroy has blocked it, and Google Safe Browsing flags it for SOCIAL_ENGINEERING. VirusTotal reports five detections out of ninety‑five scanners. Registration was performed through MarkMonitor, Inc. on May 08 2013. No additional content analysis is available, so the exact phishing page layout remains unknown. Defenders should block the domain at network perimeter and DNS level, include it in URL filtering policies, and monitor for any related C2 traffic. Users should be warned that any request to this domain claiming to be LinkedIn is illegitimate, and credential‑submission attempts should be reported.