swissborglgin--sso-authh[.]webflow[.]io

Analysis indicates that the domain swissborglgin--sso-authh.webflow.io is actively hosted on Webflow's infrastructure, as the registrar information shows registration through Webflow, Inc. The authoritative name server data is unavailable (NS_NOT_FOUND), suggesting that the domain relies on Webflow’s default DNS configuration. DNS resolution points to IP address 104.18.36.248, which belongs to Cloudflare’s edge network, a common hosting choice for legitimate and malicious sites alike. The domain appears on a single security blocklist and is currently listed by PhishDestroy, confirming that at least one anti‑phishing service has taken mitigation action. VirusTotal has recorded detections from 11 of 95 scanned engines, indicating that a minority of AV vendors have identified malicious characteristics. No additional public threat‑intel feeds such as OTX or Google Safe Browsing are cited in the available data, and no SSL certificate details, HTTP response codes, or page title information have been disclosed. Consequently, the level of confidence in the phishing nature of the site rests on the blocklist listing, the PhishDestroy flag, and the multi‑engine detections. Defenders should block or quarantine network traffic to the domain, add the domain to internal URL filtering and email security policies, and monitor DNS queries for the associated IP address 104.18.36.248 for related activity. Because the domain is hosted on a shared CDN, other malicious sites may resolve to the same IP, so broader IP‑based blocking should be evaluated against business impact. Continuous re‑evaluation is advised as additional intelligence, such as page content analysis or further vendor detections, becomes available.