krekkkvlogin[.]webflow[.]io

Analysis of the domain krekkkvlogin.webflow.io indicates it was actively flagged as a credential phishing threat prior to being taken offline on or before July 24, 2026. Infrastructure evidence reveals the domain was hosted on Cloudflare infrastructure, resolving to IP 172.64.151.8 (AS13335, United States) and secured with a Google Trust Services SSL certificate (WE1). The domain was registered through Cloudflare on March 2, 2026, and was detected using Cloudflare and HTTP/3 technologies.

At the time of assessment, the domain returned an HTTP 404 status with the page title '404 - Page not found,' suggesting the phishing content was removed or the site was disabled. Three of 93 security vendors on VirusTotal flagged the domain as malicious, and it appeared on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The scam type was explicitly classified as credential phishing in available threat intelligence.

While the domain is no longer accessible, defenders should treat any prior connections or submissions to this domain as compromised credentials. Organizations are advised to review logs for interactions with 172.64.151.8 and krekkkvlogin.webflow.io, particularly between March and July 2026, and rotate exposed credentials. No brand or specific phishing kit was identified in the available data, and the exact content of the phishing page remains unanalyzed.