email-member-and-password-update[.]webflow[.]io

PhishDestroy identifies the domain email-member-and-password-update.webflow.io as an active credential phishing threat under investigation. This Webflow-hosted site is designed to trick users into surrendering sensitive login credentials, posing a direct risk to personal and organizational security.

This domain was flagged with a risk level of 'under_investigation' due to its clear intent to harvest user credentials under the guise of an email member and password update portal. Technical analysis reveals the domain resolves to IP 172.64.151.8 and is secured with a Google Trust Services SSL certificate, which may lend false legitimacy to unsuspecting visitors. The domain currently shows 0 detections out of 95 scans on VirusTotal, indicating it has evaded widespread automated detection. Additionally, it has been blocked by two major security platforms—OpenPhish and OISD—highlighting its malicious nature despite low detection rates. The infrastructure is hosted on Webflow, a legitimate platform often abused for phishing due to its ease of use and rapid deployment capabilities.

Given the credential theft intent of this domain, users are strongly advised to avoid interacting with any links or forms associated with email-member-and-password-update.webflow.io. Organizations should implement email filtering rules to block messages referencing this domain or similar patterns. Employees must be reminded to verify unexpected login prompts through official channels and enable multi-factor authentication (MFA) on all critical accounts. If credentials were entered, users should immediately reset passwords and monitor accounts for suspicious activity. Report any exposure to IT security teams and consider using password managers that flag known phishing domains to prevent future incidents.