shared-document-cfb9de[.]webflow[.]io

This domain, shared-document-cfb9de.webflow.io, is identified as a credential theft operation designed to harvest user login credentials under the guise of a document-sharing service. Analysis of the page title, "Shared Document," and infrastructure patterns indicates an attempt to mimic legitimate file-sharing platforms, a common tactic in credential harvesting campaigns. No explicit brand impersonation or crypto drainer kit signatures were observed, but the generic presentation aligns with opportunistic credential theft targeting corporate or personal accounts. Infrastructure analysis reveals the domain resolves to the IP address 172.64.151.8, hosted on a content delivery network commonly used to obscure origin servers. The domain was registered through Webflow on June 8, 2026, though the creation date may reflect automated provisioning rather than malicious intent at inception. Detection metrics include a VirusTotal score of 15/95 security vendors flagging the domain, with active listings on two blocklists: PhishDestroy and OISD. The SSL certificate, issued by Google Trust Services, provides encrypted connections but does not validate legitimacy. Gridinsoft assigns a trust score of 0/100, further corroborating malicious classification. As of the latest assessment, the domain has been taken offline, likely due to enforcement actions by the hosting provider or security vendors. Despite its inactive status, residual risk persists for users who may have interacted with the domain prior to takedown. Organizations are advised to audit logs for connections to 172.64.151.8 and shared-document-cfb9de.webflow.io, while end users should reset credentials if exposure is suspected. Proactive monitoring of newly registered Webflow subdomains with similar naming conventions is recommended to preempt future campaigns.