kuikoinslgnius[.]webflow[.]io

Analysis of the domain kuikoinslgnius.webflow.io indicates it is actively involved in phishing operations targeting cryptocurrency users, as of July 27, 2026. The domain is hosted on Webflow, Inc.'s infrastructure and resolves to the IP address 104.18.36.248, which is associated with Cloudflare's content delivery network. Infrastructure analysis reveals the domain lacks configured nameservers, a common tactic to obscure ownership and complicate takedown efforts. Despite this, the domain remains accessible, suggesting ongoing malicious activity.

Eight out of ninety-one security vendors on VirusTotal have flagged this domain, corroborating its classification as a high-risk threat. It is currently blocked by PhishDestroy and appears on at least one additional security blocklist, further supporting its malicious designation. The domain's registration details are obscured by Webflow's hosting service, limiting visibility into the registrant's identity or geographic origin. However, the use of Webflow—a legitimate platform often exploited for rapid deployment of phishing sites—aligns with observed tactics in similar campaigns.

Defenders should prioritize blocking access to this domain at the network level, particularly in environments where cryptocurrency transactions or financial data are handled. Monitoring for connections to 104.18.36.248 may also help identify compromised systems or ongoing phishing attempts. While the exact content of the site has not been analyzed, the combination of detection by multiple security vendors, absence of legitimate nameserver configuration, and active blocklisting strongly suggests it is designed to deceive users into divulging sensitive information or transferring cryptocurrency. Organizations are advised to treat this domain as hostile until further evidence confirms its legitimacy.