koucenelogine[.]webflow[.]io

The domain koucenelogine.webflow.io is currently listed on a single public security blocklist and is actively blocked by the PhishDestroy feed. Analysis of VirusTotal submissions shows that fourteen out of ninety‑one scanning engines have raised a malicious classification, indicating that the site exhibits observable phishing‑related behavior. Registration details reveal the domain was provisioned through the Webflow service, a platform that supplies hosting and DNS for user‑generated sites. The domain does not return a standard set of authoritative name servers; the nameserver query returns no records, which is consistent with Webflow’s default DNS configuration that often relies on hidden infrastructure.

DNS resolution points to the address 172.64.151.8, an IP belonging to a large content‑delivery network commonly used for rapid site deployment. The presence of a CDN does not mitigate the risk posed by the underlying content, as the detection signals originate from the payload served at the resolved address. At this time, no additional intelligence such as page titles, SSL certificate details, or HTTP response codes has been published, leaving the exact content and lure tactics of the site unverified. Nevertheless, the combination of blocklist inclusion, active feed blocking, and multi‑vendor detections constitutes a high confidence indicator that the domain is being used for credential‑phishing operations.

Defenders should add the domain to deny‑list rules at perimeter firewalls, DNS resolvers, and proxy appliances. Continuous monitoring of the IP 172.64.151.8 for new hostnames is advised, as Webflow accounts may spawn additional phishing pages under the same infrastructure. Threat‑intel teams should also query the blocklist source for any future updates and consider submitting the domain to additional sandbox services to enrich the behavioral profile.