is5385.craftum.io
Category: Phishing
- Don't sign in or pay here. Close it. If you typed a password, change it where you normally use it.
- Already visited? Check your device. A free scan shows whether anything was installed.
- Stop the next one. Combo Cleaner's web protection blocks phishing and scam sites before they load.
Combo Cleaner is PCrisk's own anti-malware tool, owned by RCS LT. Free to scan; removing what it finds needs a licence (7-day free trial).
Quttera Web Malware Removal is a paid subscription service. Pricing, plans, and trial availability are set by Quttera. Quttera is operated by Quttera Ltd, an independent third-party company unrelated to RCS LT. PCrisk.com may earn a referral commission when users sign up through this link.
Description of is5385.craftum.io
is5385.craftum.io appears to be a subdomain hosted on the Craftum website-building platform rather than a standalone branded domain. Based on the screenshot, the page currently shows a minimal message asking the visitor to provide an email parameter in the URL, which suggests it may be part of a template, landing page flow, or a dynamically generated page intended to personalize content for a specific recipient.
Safety Assessment for is5385.craftum.io
Several scan signals indicate caution is warranted. At the time of this scan, 4 out of 91 security engines flagged the URL, including phishing and suspicious classifications, and the page content itself is unusually sparse. The screenshot shows a request to supply an email address directly in the URL, which can be consistent with targeted landing pages sometimes used in credential-harvesting or campaign-style delivery flows.
Additional scan data found 2 flagged page elements and one referenced external resource that was marked as suspicious by a malware scanner. While major content-malice blocklists checked here were clean at the time of the scan, the domain's IP address was listed on one mail-reputation blocklist, which is a weaker signal but still worth noting. Taken together, these findings suggest the site may pose potential risks to visitors.
Technical Description
The site was served over HTTPS with a valid TLS certificate issued by GlobalSign and hosted behind an nginx web server on infrastructure attributed to JSC "TIMEWEB" in St Petersburg, Russia. The domain is about 5 years old, uses Craftum nameservers, and resolves to IP address 92.255.111.71.
From a security-configuration perspective, DNSSEC appears to be unsigned, and the scan identified a suspicious external resource loaded from 274418.selcdn.ru. The page also lacks normal site metadata and presents only a parameter prompt, which may indicate a narrowly purposed landing page rather than a conventional public website.
Share your experience with this website. Was it safe? Did you encounter any issues?