dropbox-home-page-cloneable[.]webflow[.]io

Analysis indicates that dropbox-home-page-cloneable.webflow.io was associated with a fake login phishing threat and is currently offline. The observed page title, "Dropbox-Home-Page-Cloneable," suggests the infrastructure was designed to replicate the appearance and functionality of a legitimate login or landing page. Based on available intelligence, the domain has been taken offline, reducing immediate exposure; however, its historical indicators remain relevant for threat hunting, retrospective investigations, and defensive monitoring.

Technical assessment reveals that the domain was flagged by 18 of 95 VirusTotal security vendors. Registration records show a creation date of March 06, 2026, and the domain was registered through MarkMonitor, Inc. Infrastructure analysis identified resolution to IP address 172.64.151.8, located in the United States within AS13335 Cloudflare, Inc. The SSL certificate was issued by Google Trust Services / WE1. The domain appeared on 1 security blocklist and was blocked by PhishDestroy. The combination of phishing-related detections, recent registration timing, cloned-page characteristics indicated by the page title, and security vendor consensus contributed to its elevated risk classification.

At the time of analysis, the domain status is offline, indicating that the identified content is no longer actively accessible. Even so, historical indicators should be retained within detection systems to support correlation against related infrastructure, reused page templates, and future campaigns. Security teams should continue monitoring for derivative domains, matching page titles, certificate reuse patterns, and associated network indicators. Users and administrators are advised not to trust credentials previously entered into the site, to review account activity for potential compromise, and to ensure endpoint and network security controls maintain blocks for the identified domain and related indicators. Although the infrastructure is no longer active, the documented evidence supports treating the domain as a previously elevated-risk fake login phishing asset.