kreqenlogin[.]webflow[.]io

The domain kreqenlogin.webflow.io was created on March 12 2026 via the Webflow registrar. It resolves to the Cloudflare‑owned address 104.18.36.248 (AS13335, United States). The TLS certificate presented is issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS endpoint. HTTP requests return a 404 – Page not found response, suggesting the front‑end content has been removed or the site is intentionally taken offline.

Despite the lack of visible content, the domain is classified as a credential phishing operation. Analysis on VirusTotal shows that nine of ninety‑four scanning engines have flagged the domain as malicious, and the domain is currently listed on three public blocklists, including PhishDestroy, MetaMask and SEAL. The infrastructure uses Cloudflare’s HTTP/3 service, a common choice for malicious actors seeking DDoS protection and anonymity. The presence of a legitimate SSL certificate does not mitigate the risk, as the certificate is automatically provisioned by the hosting platform and can be obtained by any domain owner.

At this time, no additional payload, landing page, or target brand information has been observed; the only concrete indicator is the domain’s classification as credential phishing. Defenders should block any outbound connections to 104.18.36.248, add kreqenlogin.webflow.io to DNS deny lists, and monitor for similar Webflow‑hosted subdomains that appear shortly after registration. Because the site is offline, active exploitation is unlikely, but the domain may have been used previously to harvest credentials or could be re‑activated. Continuous threat‑intel feeds should be consulted for updates, and incident response teams should correlate any internal authentication logs that reference this domain with potential credential compromise.