crakenzuslogin[.]webflow[.]io

The domain crakenzuslogin.webflow.io is currently active and resolves to the IP address 172.64.151.8, which belongs to the hosting infrastructure used by Webflow, Inc. The registration is recorded through Webflow, indicating that the domain was created using the platform’s free sub‑domain service. Google Safe Browsing has classified the site under the “social engineering” category, a label commonly applied to credential‑collection pages. Seven of ninety‑one security scanners on VirusTotal have raised detections, reinforcing the suspicion that the site is being used for malicious purposes. The domain appears on three independent blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, demonstrating that multiple threat‑intel feeds have already flagged it as hostile.

Nameserver resolution failed (NS_NOT_FOUND), which may reflect the use of Webflow’s internal DNS handling rather than a public authoritative server. No public TLS certificate details, HTTP response codes, or page title information are available in the current intelligence set, leaving the exact content of the landing page unverified. Consequently, the precise brand or service that the site attempts to impersonate cannot be confirmed at this time.

Defenders should treat the domain as high‑risk given the combination of active hosting, safe‑browsing flag, multi‑vendor detections, and inclusion on reputable blocklists. Recommended actions include adding the domain to outbound web filters, configuring DNS sink‑hole rules for the associated IP range, and monitoring for any traffic spikes that may indicate credential‑harvesting campaigns. Continuous re‑evaluation is advised, as further analysis of the page payload or TLS fingerprint could provide additional attribution.