kukooinlogoni[.]webflow[.]io

PhishDestroy identifies kukooinlogoni.webflow.io as a **fake login portal phishing domain** currently under investigation but actively hosting malicious content. This fraudulent site impersonates legitimate authentication interfaces to harvest user credentials, posing significant risks to unsuspecting visitors. The domain is hosted on Webflow’s infrastructure (IP: 172.64.151.8) and leverages Google Trust Services SSL certificates to appear legitimate, increasing the likelihood of successful deception. Due to its active status and low detection rates, this threat requires immediate scrutiny from security teams and end-users alike. This domain exhibits several red flags confirmed by authoritative sources. VirusTotal currently flags the site with **0 detections out of 95 engines**, indicating it has evaded widespread recognition despite its malicious intent. The domain resolves to Cloudflare IP range (172.64.151.8), a common hosting provider often exploited by threat actors to obscure malicious infrastructure. While Google Trust Services issued the SSL certificate, this alone cannot validate the domain’s legitimacy—a critical consideration for phishing prevention. Webflow’s domain registration obscures ownership details, and no known blocklists have flagged this domain yet. The absence of historical data suggests recent deployment, typical of opportunistic credential-harvesting campaigns. To mitigate risks associated with fake login portal phishing, users should verify URLs meticulously before inputting credentials. Never trust unsolicited login prompts, even those appearing legitimate via HTTPS. Organizations should deploy browser-based phishing detection tools and educate employees on identifying spoofed domains. Report suspicious activity to PhishDestroy or local CERT teams to aid ongoing threat intelligence efforts. Immediate actions include blocking the domain at the network perimeter and scanning endpoints for unauthorized credential submissions.