caddyflow-webflow-agency-airbnb[.]webflow[.]io

The domain caddyflow-webflow-agency-airbnb.webflow.io was created on 22 March 2026 and is currently serving a page titled “Caddyflow Webflow Agency : Airbnb Single Property Page”. The site returns HTTP 200 and presents a replica of Airbnb’s property‑listing interface, indicating a deliberate brand‑impersonation campaign aimed at extracting cryptocurrency wallets, as classified in the intelligence as a “Crypto Drainer”. The page is hosted on the Webflow platform and fronted by Cloudflare, which also supplies HTTP/3 support. A Calendly widget is visible, suggesting an attempt to collect victim contact information or schedule fraudulent calls. Technical probing shows the domain resolves to the IP address 172.64.151.8, which belongs to Cloudflare, Inc. and is geolocated to Canada. The TLS certificate is issued by Google Trust Services under the WE1 name, providing a valid certificate chain but offering no indication of the underlying operator. Reputation services rate the site extremely poorly: Scamadviser assigns a trust score of 1 / 100, Gridinsoft reports 0 / 100, and VirusTotal flags the domain with 14 detections out of 95 security vendors. The domain appears on a single security blocklist and has already been flagged by the PhishDestroy blocking service. Given the combination of a fresh registration, high‑confidence brand mimicry, and the presence of a crypto‑draining payload, the risk level is assessed as high. The operator’s identity remains unknown, and the full extent of the wallet‑extraction mechanism has not been disclosed publicly. Defenders should immediately block any outbound or inbound traffic to this domain, update web filtering rules to include the full hostname, and monitor for related indicators such as connections to the resolved IP address or use of Calendly links on similar impersonation pages. Continuous intelligence gathering is advised to capture any evolving tactics or additional infrastructure that may be deployed.