verifynow-8d1935[.]webflow[.]io

Security researchers at PhishDestroy have identified verifynow-8d1935.webflow.io as an active credential theft domain designed to harvest user login details under the guise of an identity verification portal. The site is currently classified with an elevated risk rating due to confirmed malicious activity and remains accessible as of the latest analysis. Users interacting with this domain risk exposing sensitive credentials to unauthorized third parties.

This domain was flagged by 17 of 95 VirusTotal security vendors and blocked by OpenPhish, indicating widespread detection of its malicious intent. It resolves to IP address 104.18.36.248 and operates under Google Trust Services for SSL encryption. The domain resides on Webflow’s infrastructure and has been identified on one external security blocklist. These factors collectively reinforce the elevated threat level associated with this campaign.

Given the active status and confirmed credential theft functionality, PhishDestroy recommends immediate network and endpoint inspection for signs of compromise related to this domain. Users should avoid accessing the site or submitting any personal or login credentials. Organizations are advised to update blocklists with this domain and associated IP, and to deploy user awareness training emphasizing verification of unexpected verification requests. Continuous monitoring for related artifacts is strongly encouraged to prevent credential exposure.