web-kraken-sso[.]webflow[.]io

Analysis of web-kraken-sso.webflow.io indicates that the domain is currently active and has been classified as a generic phishing threat with a high risk rating. The domain resolves to the IP address 172.64.151.8, which is hosted on infrastructure provided by Webflow, Inc., the registrar listed in the registration records. VirusTotal scans show that 14 of 91 security vendors have flagged the domain, providing a modest but notable detection rate that aligns with its phishing designation.

The domain is listed on three known security blocklists and is actively blocked by PhishDestroy, OpenPhish, and Phishunt, confirming that multiple threat intelligence feeds have identified it as malicious. Nameserver data is unavailable (NS_NOT_FOUND), limiting insight into the authoritative DNS configuration. No additional evidence such as page titles, SSL details, or HTTP response codes has been disclosed, leaving the surface‑web characteristics unexamined.

Defenders should prioritize blocking the domain at perimeter firewalls, DNS resolvers, and endpoint protection solutions, given its confirmed presence on reputable phishing blocklists. Continuous monitoring of the associated IP address for any changes in hosting or additional malicious activity is advised, as is periodic re‑query of VirusTotal and other scanning services to capture any shift in detection counts. Organizations should also consider adding the domain to internal threat intelligence feeds and alerting users to avoid any login prompts or credential‑harvesting pages that may be served from this URL.