krukanloqin[.]webflow[.]io

PhishDestroy identifies krukanloqin.webflow.io as an active crypto drainer domain currently under investigation. This Webflow-hosted page mimics legitimate services to siphon cryptocurrency from unsuspecting users. The infrastructure leverages Google Trust Services for SSL validation while resolving to IP 172.64.151.8 — a known dynamic hosting range. This domain presents minimal detection on VirusTotal with 11/95 security engines flagging it at the time of analysis. The associated SSL certificate, issued by Google Trust Services, shows no anomalies in trust scores, complicating initial detection. Active resolution points to 172.64.151.8, a Cloudflare-owned IP often used for fast-flux service delivery. While creation details remain unlisted in public WHOIS records, the zero detection rate suggests either recent deployment or highly evasive tactics. Mitigation requires immediate verification through PhishDestroy’s crawlers. Users who encounter this domain should avoid interaction entirely and report it via PhishDestroy’s portal. Blocking 172.64.151.8 at the network perimeter can prevent further exploitation. Webflow administrators should be notified to suspend the subdomain if malicious content is confirmed.