l0ginxftjtjtjupdatetjtj96956200ne9tj[.]webflow[.]io

Analysis conducted on July 22, 2026 identifies l0ginxftjtjtjupdatetjtj96956200ne9tj.webflow.io as an active credential phishing domain hosted on Webflow infrastructure. The domain currently resolves to IP address 172.64.151.8, which is part of a network range frequently associated with content delivery and hosting services. No nameserver records were detected during the investigation, which may indicate an incomplete or obfuscated DNS configuration. The domain is registered through Webflow, Inc., a legitimate platform used for website creation and hosting, though it is commonly exploited by threat actors to deploy phishing pages due to its ease of use and free tier availability. At the time of analysis, the domain appears on two security blocklists: PhishDestroy and OpenPhish, both of which specialize in tracking and mitigating phishing threats.

Detection data from VirusTotal indicates that 9 out of 95 security vendors have flagged this domain as malicious, suggesting moderate consensus among detection engines regarding its harmful nature. No specific brand impersonation or targeted service has been confirmed in the available data, and the exact content of the phishing page remains unanalyzed. However, the domain name contains fragments such as 'loginx' and 'update,' which are commonly used in credential harvesting campaigns to deceive users into entering sensitive information. The domain remains active as of the report date, with no indication of takedown or remediation efforts.

Defenders are advised to block the domain and its resolving IP address at the network level. Security teams should monitor for connections to 172.64.151.8 and review logs for any user interactions with l0ginxftjtjtjupdatetjtj96956200ne9tj.webflow.io. Given the domain's presence on multiple blocklists and detection by security vendors, organizations should treat any access attempts as high-risk events and investigate accordingly.