sbcverify-1e6d20[.]webflow[.]io

Analysis of sbcverify-1e6d20.webflow.io, observed on July 22 2026, shows that the domain is actively used for credential phishing. The site is hosted on Webflow’s infrastructure and resolves to the IP address 172.64.151.8, an address associated with Cloudflare‑provided services. Registration information indicates the domain was created through Webflow, Inc., and no authoritative nameserver records are returned (NS_NOT_FOUND).

Multiple threat‑intel feeds have flagged the domain: PhishDestroy and OpenPhish list it as blocked, Google Safe Browsing classifies it as a social‑engineering site, and two independent blocklists contain the domain. VirusTotal reports that 15 of 95 scanned security vendors have flagged the domain as malicious, confirming a consensus of detection across disparate scanners. No public SSL certificate details, HTTP response codes, or page‑title metadata have been published, so the surface‑level web content remains unexamined.

The absence of OTX references or additional contextual indicators leaves the broader campaign attribution uncertain. Defenders should add the domain and its resolving IP to outbound‑allow and inbound‑deny rules, update URL filtering policies to block the host, and monitor for any login credential submissions that may be directed to the address. Continuous re‑scanning with VirusTotal and periodic checks against the listed blocklists are recommended to capture any changes in classification.