ghezminelogon[.]webflow[.]io

Analysis conducted on August 02, 2026 identifies ghezminelogon.webflow.io as an active phishing domain hosted on Webflow infrastructure. The domain currently resolves to IP address 104.18.36.248, which is part of a content-delivery network operated by Cloudflare. No nameservers are detected for this subdomain, a configuration consistent with Webflow’s managed hosting environment. The registrar of record is Webflow, Inc., and the domain remains operational as of the report date.

Thirteen of ninety-one security vendors on VirusTotal have flagged this domain, indicating detection by multiple engines but not universal consensus. The domain appears on at least one security blocklist and is specifically blocked by PhishDestroy. No further brand impersonation, scam classification, or page content has been confirmed in available intelligence; the exact target of the phishing attempt is not yet analysed. Defenders are advised to treat this domain as high-risk based on detection volume and blocklist presence.

Network-level blocking at 104.18.36.248 and domain-level filtering of ghezminelogon.webflow.io are recommended. Since the domain is hosted on a legitimate platform, takedown requests should be directed to Webflow’s abuse team with supporting evidence from detection reports. Continuous monitoring is warranted due to the domain’s active status and unresolved detection discrepancies.