verifyverifying-44024c[.]webflow[.]io

P1: This domain verifyverifying-44024c.webflow.io is assessed as a credential phishing endpoint designed to imitate login verification workflows. The page title "verifyverifying" reflects a generic authentication prompt intended to mislead users into submitting sensitive credentials such as usernames, passwords, or session tokens. The infrastructure is currently reported as offline, consistent with enforcement action or takedown following detection and abuse reporting across security systems.

P2: Evidence indicates multi-source malicious classification. The domain is flagged by 21/95 VirusTotal security vendors and is listed by Google Safe Browsing as a phishing resource. It is additionally blocked by PhishDestroy and appears on 1 independent security blocklist. Registration is attributed to Webflow, with domain creation dated April 28, 2026. The host resolves to IP 104.18.36.248 and is served via Cloudflare infrastructure in CA (AS13335). Transport security is provided via an SSL certificate issued by Google Trust Services (WE1), which is commonly abused in impersonation campaigns to increase perceived legitimacy.

P3: Any user interaction with this domain should be treated as a potential credential compromise event. If credentials were entered, immediate mitigation steps include password reset on affected accounts, revocation of active sessions, and enabling multi-factor authentication where available. Users should also inspect email or account logs for unauthorized access originating after exposure. Endpoint security scans are recommended to rule out secondary payload delivery or session hijacking artifacts. Network defenders should maintain blocking rules for verifyverifying-44024c.webflow.io and related infrastructure patterns, monitor for similar Webflow-hosted impersonation pages, and correlate DNS or proxy logs for attempted access prior to takedown. Given the 21/95 detection rate and confirmed phishing classification, residual risk persists through cloned or rapidly rehosted variants using similar naming conventions.