www-currently-sign-in-cd7f8e[.]webflow[.]io

PhishDestroy identifies www-currently-sign-in-cd7f8e.webflow.io as an active credential-harvesting page posing as a login portal to trick users into surrendering email and password combinations. The site uses a Google Trust Services SSL certificate and resolves to IP 172.64.151.8, yet 12 out of 95 VirusTotal security vendors have already marked it malicious. This domain first appeared very recently and was registered with Webflow, Inc. VirusTotal’s consortium of scanners recorded the first detections within hours of the domain going live, indicating a fast-moving campaign. The low detection ratio at launch is common with newly spun-up phishing pages that have not yet been widely blacklisted. If you visited www-currently-sign-in-cd7f8e.webflow.io, assume your credentials may have been compromised. Immediately change the password for any account where you reused that combination and enable multi-factor authentication. Scan your device for malware and review account login histories for any unfamiliar sessions. Report the domain to your IT team or use your browser’s built-in safety report feature to help block it for others.