juno-update-24c16f[.]webflow[.]io

This domain, juno-update-24c16f.webflow.io, is identified as a credential theft operation designed to harvest login credentials by impersonating a legitimate financial service update portal. The page title 'Juno Update' suggests an attempt to deceive users into believing they are interacting with a trusted financial platform, likely targeting customers of a service named Juno. The goal is to trick victims into entering sensitive account details, which are then exfiltrated to attacker-controlled infrastructure for unauthorized access or financial fraud. Analysis of the domain reveals multiple technical indicators supporting its malicious classification. The domain is flagged by 17 out of 95 security vendors on VirusTotal, indicating widespread detection as a threat. It appears on two independent security blocklists, further corroborating its malicious intent. The domain was registered through MarkMonitor, Inc. on May 8, 2013, though the subdomain hosting the phishing content is a more recent addition, leveraging the reputation of the Webflow platform to evade initial scrutiny. Infrastructure analysis shows the domain resolves to the IP address 172.64.151.8, hosted on Cloudflare's network (AS13335), a common tactic to obscure the true origin of the attack and leverage Cloudflare's SSL termination for perceived legitimacy. Users who visited juno-update-24c6f.webflow.io should assume their credentials have been compromised if any login details were entered. Immediate steps include revoking access to any accounts associated with the credentials provided, enabling multi-factor authentication where available, and monitoring for unauthorized transactions or account activity. Passwords for the affected accounts and any reused credentials should be changed across all platforms. Additionally, users should review their systems for any unexpected downloads or installations, as phishing pages may also distribute malware. If financial information was entered, affected individuals should contact their financial institution to report potential fraud and place fraud alerts on their accounts.