swissborgloginev[.]webflow[.]io

On August 07, 2026 the domain swissborgloginev.webflow.io was observed being used in a credential phishing campaign targeting users of the SwissBorg platform. The domain is registered through the Webflow hosting service, which provides rapid site deployment and automatic TLS. DNS resolution points to the IP address 104.18.36.248, an address owned by Cloudflare, indicating the infrastructure is leveraging a shared CDN edge node. The site has been added to two independent phishing blocklists, PhishDestroy and OpenPhish, and both services currently list the domain as blocked.

VirusTotal analysis shows that 17 of 91 security vendors submitted a detection, confirming that a significant minority of scanners recognize malicious behavior. The domain appears on two broader security blocklists, reinforcing the consensus that it is being used for malicious purposes. No additional public intelligence such as page title, SSL certificate details, or HTTP response codes has been disclosed, leaving the exact content of the landing page unverified. The lack of further forensic artifacts means that attribution of the operators and the specific phishing kit remains uncertain.

Defenders should block network traffic to the domain and its resolved IP, add the host to local and cloud‑based URL filtering lists, and monitor for credential submissions that match SwissBorg login patterns. Continuous monitoring of the IP reputation and periodic rescans on VirusTotal are recommended, as the detection count may evolve. Users should be warned that any login prompt originating from swissborgloginev.webflow.io is likely fraudulent and should be ignored.