# kocoinlogini.webflow.io — MALICIOUS

> kocoinlogini.webflow.io hosts a high-risk credential phishing scam targeting users. Stay alert and avoid sharing login details. Report suspicious activity now.

## Summary
PhishDestroy identifies kocoinlogini.webflow.io as an active credential phishing domain designed to steal user login information. The page title mimics legitimate branding with subtle misspellings to deceive users.

Technical indicators include a recent domain creation date of March 11, 2026, and resolution to IP 172.64.151.8. The domain is flagged by 20 out of 95 VirusTotal security vendors and appears on one security blocklist, confirming its malicious intent.

The domain remains active and continues to pose a threat. Users and security teams are advised to block access and report any interactions. PhishDestroy will monitor for further activity related to this phishing campaign.

## Threat Details
- Verdict: MALICIOUS
- Site status: alive (HTTP 200)
- Page title: ꝄuCoin® ℓoℊin@% A Step-by-tep Guide to Access Your Account

## Domain Intelligence
- Registered: 2026-03-11 15:07:01
- IP: 172.64.151.8
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: NS_NOT_FOUND
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 20 vendors flagged
  Vendors: ["ADMINUSLabs", "alphaMountain.ai", "BitDefender", "Chong Lua Dao", "CyRadar", "ESET", "Emsisoft", "Forcepoint ThreatSeeker", "Fortinet", "G-Data", "Gridinsoft", "Kaspersky", "LevelBlue", "Lionic", "Netcraft", "OpenPhish", "Phishtank", "Sophos", "VIPRE", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019ce201-0866-72fa-a318-205f95763eaa.png
- PhishDestroy: https://phishdestroy.io/domain/kocoinlogini.webflow.io/
- LLM endpoint: https://phishdestroy.io/domain/kocoinlogini.webflow.io/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/kocoinlogini.webflow.io/
Last updated: 2026-03-19