kerkanlogixn[.]webflow[.]io

PhishDestroy identifies a live phishing page hosted at kerkanlogixn.webflow.io that impersonates a legitimate invoice portal in an attempt to harvest payment credentials. The site uses SSL encryption via Google Trust Services (GTS CA 1C3) to appear authentic, resolving to IP 172.64.151.8. Scans by VirusTotal show only 4 out of 95 security engines currently detect the threat, leaving many users unprotected if relying solely on automated tools.

This domain was flagged on March 12, 2024, by PhishDestroy’s crawlers within hours of activation, and was registered through Cloudflare, Inc. with a two-year lifespan beginning February 29, 2024. Analysis indicates the campaign is part of a broader trend using Webflow subdomains to bypass traditional email security filters, leveraging legitimate hosting services to deliver convincing invoice spoofs with embedded credential-harvesting forms.

If you or your employees have interacted with this domain—especially entering any login or payment information—immediately lock the affected account, rotate passwords using a separate device, and scan all connected systems for malware. Report the incident to your finance team and consider enabling multi-factor authentication on all payment portals. Forward any suspicious emails to your SOC for deeper inspection, and block both the domain and IP at your firewall.