karukenloge[.]webflow[.]io

Analysis of karukenloge.webflow.io shows the domain is currently offline, returning HTTP 404 with the page title “404 - Page not found”. The host resolves to 172.64.151.8, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. DNS resolution uses Cloudflare name servers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and the site was served over HTTP/3, confirming the presence of Cloudflare’s edge infrastructure. The TLS handshake presents a certificate issued by Google Trust Services under the WE1 label, indicating a valid, publicly trusted certificate chain.

Registrar data reveals the domain was registered through MarkMonitor, Inc. on May 08 2013. Although the site is no longer reachable, multiple threat‑intelligence sources have flagged it as a phishing vector. VirusTotal reports that 14 of 95 scanned security vendors flagged the domain, and Google Safe Browsing categorises it as social engineering. The domain also appears on a single external blocklist and has been actively blocked by the PhishDestroy remediation service.

The combination of a Cloudflare‑protected host, a legitimate‑looking TLS certificate, and the presence of multiple independent detections suggests the domain was used to host a generic phishing campaign before being taken down. Because the site no longer serves content, direct exploitation is unlikely, but the historical association remains relevant for correlation with other malicious artifacts that may reference the same infrastructure. Defenders should continue to monitor the IP address 172.64.151.8 for any re‑activation, ensure that any URLs or emails containing the domain are blocked at the gateway level, and consider adding the domain to internal blocklists. Ongoing vigilance is recommended, as the underlying Cloudflare account could be repurposed for future malicious deployments.