nowverify[.]webflow[.]io

The domain nowverify.webflow.io has been confirmed as a credential phishing site designed to harvest login credentials through fraudulent authentication portals. Analysis indicates the infrastructure was actively impersonating cloud service providers to deceive users into submitting sensitive account details. The domain is currently offline, though historical activity suggests a targeted campaign against enterprise or individual cloud users. Infrastructure analysis reveals the domain was created on May 08, 2013, and resolves to the IP address 104.18.36.248, hosted on autonomous system AS13335 operated by a global content delivery network. The domain is registered through MarkMonitor, Inc., a registrar commonly associated with both legitimate and malicious domains. Security vendors flagged this domain on VirusTotal, with 14 of 95 engines detecting it as malicious. The site appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services under the WE1 root, a common certificate authority that does not inherently validate domain legitimacy. The page title, '404 - Page not found,' suggests the phishing content was removed or the site was abandoned following detection. Current status indicates the domain is offline, though residual risk remains due to potential reuse of the infrastructure or migration of the phishing campaign to alternative domains. Organizations and individuals are advised to block the domain and IP address at the network level, revoke any credentials potentially exposed through this site, and monitor for related indicators of compromise. Security teams should review logs for connections to 104.18.36.248 or nowverify.webflow.io during the period of activity. Users who interacted with the domain should assume credential compromise and enable multi-factor authentication on all critical accounts. Proactive threat hunting for similar domains registered through MarkMonitor or resolving to Cloudflare IPs may identify related phishing infrastructure.