Has anyone else using Webflow had clients report receiving emails claiming their website has been hacked and requesting ransom in bitcoin? We've had two clients report this issue in one morning. Any advice or insight would be greatly appreciated.

Yes, several Webflow users have reported similar scareware or phishing emails—these are common spam tactics, and they're not typically linked to an actual website breach. Here’s what’s going on and how to respond.

​

1. Understand the Type of Attack

​

• This is commonly known as a sextortion scam or phishing email, often claiming the site has been “hacked” or that data has been stolen.
• The email usually includes a Bitcoin wallet, a warning not to “alert authorities,” and vague threats.
• These emails are typically automated and sent in bulk to publicly listed domain registrant emails or emails found on the site itself.

​

2. Confirm There's No Real Breach

​

• Check your Webflow project settings for unauthorized changes, particularly in CMS content, custom code (in the Pages or Project settings → Custom Code tabs), and redirects.
• Run the website through a Google Safe Browsing check (https://transparencyreport.google.com/safe-browsing/search).
• Use tools like Have I Been Pwned (https://haveibeenpwned.com/) to check if any associated admin email addresses were found in past breaches.

​

3. Check Your DNS & Domain

​

• Log into your domain provider and confirm there’s no unauthorized activity.
• Ensure DNS records (especially A records and CNAME) still point to Webflow: (a) 75.2.70.75, (b) 99.83.190.102.
• Make sure domain contact information is private or anonymized—public WHOIS data can be harvested by bots.

​

4. Improve Email Security

​

• If your clients' email addresses are listed on the site, make sure they are protected using form submissions rather than mailto: links.
• Suggest they implement SPF, DKIM, and DMARC records on their mail server to reduce spam/fraud.
• Recommend using a premium email provider with built-in phishing detection (e.g., Google Workspace, Microsoft 365).

​

5. Communicate With Clients

​

• Reassure them this is a common scam not tied to any verified breach unless you find otherwise.
• Recommend not responding and not sending money.
• Direct them to mark the message as spam and possibly report it to authorities using resources like https://www.ic3.gov (if in the U.S.).

​

Summary

​

Your clients are likely the target of a widespread phishing campaign, not a real Webflow breach. Review their site settings, confirm DNS integrity, secure any public-facing emails, and reassure them they can ignore the scam messages.