otkook[.]webflow[.]io

otkook.webflow.io is a subdomain of webflow.io. PhishDestroy first recorded this hostname on Jun 26, 2026. The stored content classification is generic phishing. The assembled evidence scores 95/100 (critical).

Two independent sources are positive: VirusTotal and Cloudflare Radar. VirusTotal recorded 17 detections among 91 engines: alphaMountain.ai, BitDefender, CyRadar, ESET, Emsisoft, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, Lionic, MalwareURL, Netcraft, OpenPhish, Phishtank, Sophos, Webroot on Jul 18, 2026 at 18:45 UTC. Cloudflare Radar classified the hostname as malicious and assigned the categories phishing and security threats; its verdict timestamp was not retained. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. Google Safe Browsing returned no flag on Jun 26, 2026 at 09:37 UTC. URLScan completed without a malicious verdict (score 0) on Jun 27, 2026 at 08:14 UTC.

HTTP 404 was recorded on Aug 7, 2026 at 01:05 UTC; content was unavailable. Registration records for the registrable domain webflow.io list MarkMonitor, Inc. as the registrar and May 8, 2013 as the creation date. At collection time, the hostname resolved to 172.64.151.8 on AS13335 (CLOUDFLARENET - Cloudflare, Inc., US). The associated network metadata labels the endpoint as AS13335 Cloudflare, Inc. in San Francisco, US. The stored server header is cloudflare. Captured page title: “otkook”. DOM analysis completed on Jul 29, 2026 at 04:05 UTC; stored DOM score 0/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Jul 29, 2026 at 02:51 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists Google Trust Services / WE1 as the certificate issuer with validity through Aug 25, 2026; checked Jun 26, 2026 at 10:00 UTC.

No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. The 0/100 DOM score means that the DOM pass stored no scored indicators; it does not negate the independent source findings. Taken together, the page content and independent findings support classifying this hostname as generic phishing.