www-currently-sign-in-6fdb9c[.]webflow[.]io

This domain, www-currently-sign-in-6fdb9c.webflow.io, is identified as a high-risk brand impersonation threat targeting Google. Analysis confirms the site mimics Google’s sign-in interface, as indicated by the page title 'www.currently.sign in,' to harvest user credentials. The infrastructure is hosted on Webflow’s platform, a common vector for phishing campaigns due to its ease of deployment and SSL certificate provisioning. Technical indicators reveal the domain is flagged by 18 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly classifying it as phishing. The SSL certificate is issued by Google Trust Services (WE1), a detail often exploited to lend false legitimacy. The domain resolves to IP address 104.18.36.248, geolocated to California under Cloudflare, Inc., and appears on at least one security blocklist. No creation date is publicly available, but the active status and recent detection suggest recent deployment. The domain remains active and poses a significant risk to users encountering it through phishing emails, malicious ads, or compromised redirects. Immediate mitigation includes blocking the domain and IP at the network level, while users should verify URL authenticity before entering credentials. Despite takedown efforts, similar infrastructure often resurfaces under new subdomains or hosting providers, necessitating continuous monitoring of Webflow-hosted endpoints for impersonation threats.