broadcastauthbtbusinessintel-loginapp[.]webflow[.]io

Analysis of broadcastauthbtbusinessintel-loginapp.webflow.io indicates active credential‑phishing activity as of August 03 2026. VirusTotal reports that 13 of 91 security vendors have flagged the domain, suggesting the presence of malicious code or behavior consistent with credential‑theft campaigns. The domain appears on a single external blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the assessment of malicious intent.

Registration data shows the domain was created through the Webflow platform, a popular low‑cost website‑hosting service that is frequently leveraged by threat actors to host fraudulent pages because of its ease of use and legitimate appearance. No public information on the underlying IP address, ASN, or geographic location has been disclosed, and no SSL certificate details or HTTP response codes are currently available. Likewise, Safe Browsing, Open Threat Exchange (OTX), and other reputation services have not published additional indicators for this host, and the page title has not been captured in the available intelligence.

Defenders should treat the domain as hostile: block outbound and inbound traffic to the host, add it to internal phishing and URL filtering lists, and monitor DNS logs for any resolution attempts. Because the domain is hosted on a shared Webflow infrastructure, investigators may consider broader sweeps of sibling subdomains to identify related phishing deployments. Continuous re‑evaluation is advised as additional telemetry, such as sandbox analysis or endpoint detections, becomes available.