services-superb-site-a759fb[.]webflow[.]io

This domain, services-superb-site-a759fb.webflow.io, is assessed as an elevated-risk credential theft phishing site. Analysis indicates the infrastructure was designed to harvest user login credentials through deceptive service portals, likely mimicking legitimate platforms to exploit trust. The threat type is specifically credential theft, not generic phishing, as evidenced by the page title 'Service's Superb Site' and the structured deployment through a content management system known for facilitating such attacks. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.18.36.248 and is hosted on Webflow, a platform frequently abused for phishing campaigns. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. Security vendor detections on VirusTotal report 17/95 flags, while Gridinsoft assigns a trust score of 0/100. The domain appears on at least one security blocklist and is currently offline, though this does not preclude future reactivation. No creation date metadata was provided, but the use of a subdomain under webflow.io suggests rapid deployment typical of short-lived phishing operations. Mitigation steps for credential theft threats include immediate blacklisting of the domain and associated IP in perimeter security controls. Network defenders should inspect logs for connections to 104.18.36.248 and monitor for similar Webflow-hosted subdomains exhibiting comparable naming patterns. User awareness training should emphasize the risks of entering credentials on pages with mismatched branding or unexpected service portals, particularly those hosted on content management platforms. Organizations are advised to enforce multi-factor authentication and credential monitoring to detect unauthorized access attempts stemming from harvested credentials. Given the domain's current offline status, continuous monitoring for reactivation is recommended.