kucokalogin[.]webflow[.]io

Analysis of the domain kucokalogin.webflow.io indicates an active credential‑phishing infrastructure targeting users through a Webflow‑hosted site. The domain was registered via Webflow, Inc., a legitimate SaaS provider that offers free sub‑domains, which complicates attribution because the registrar does not reveal an individual registrant. DNS resolution points to the IP address 172.64.151.8, an address owned by Cloudflare’s network, a common hosting choice for malicious actors seeking anonymity and DDoS protection. No authoritative nameserver records were returned, suggesting the domain relies on Cloudflare’s proxy service for DNS handling.

Threat intelligence feeds have placed the domain on a single security blocklist, and PhishDestroy has actively blocked it, confirming that at least one anti‑phishing platform recognizes it as malicious. VirusTotal scans show that 15 of 91 security vendors flagged the domain, providing independent corroboration of its suspicious nature. The detection count, while not a majority, reflects a consensus among multiple AV engines that the site exhibits phishing‑related characteristics.

The current operational status is listed as active, meaning the site is still reachable and potentially serving credential‑stealing pages. However, detailed content analysis—such as page title, SSL certificate details, HTTP response codes, or Safe Browsing verdicts—has not been disclosed, leaving a gap in the visible attack surface. Consequently, defenders cannot confirm the exact brand or service being spoofed, nor can they assess the sophistication of the login interface presented to victims.

Given the available evidence, security teams should treat kucokalogin.webflow.io as a high‑risk indicator. Recommended mitigations include adding the domain to internal blocklists, enforcing URL filtering on web gateways, and monitoring network traffic for connections to the 172.64.151.8 address.