kucqoilgino[.]webflow[.]io

The domain kucqoilgino.webflow.io is currently listed as offline, returning HTTP 404 with the page title “404 - Page not found”. Registration data shows the domain was created on May 08, 2013 and was registered through MarkMonitor, Inc. The authoritative name servers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com, indicating the use of Cloudflare's DNS service. DNS resolution points to IP address 104.18.36.248, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. The TLS certificate presented is issued by Google Trust Services under the “WE1” label, confirming a valid HTTPS handshake despite the site being offline. Threat intelligence flags the domain as a generic phishing site.

It appears on one security blocklist and is specifically blocked by PhishDestroy. VirusTotal analysis shows that 12 of 95 scanning engines have reported the domain as malicious, providing independent corroboration of the phishing classification. Detected infrastructure includes Cloudflare and support for HTTP/3, which are common among malicious hosting setups. No additional content or credential‑harvesting pages have been observed, and the current 404 response suggests the phishing campaign may have been taken down or is otherwise inactive.

Defenders should continue to treat the domain as hostile. Immediate actions include adding the domain to internal deny lists, ensuring that any outbound traffic to 104.18.36.248 is blocked, and confirming that existing web‑filtering solutions flag the domain as malicious. Monitoring for re‑registration or changes in DNS records is advisable, as threat actors often resurrect compromised domains. Because the domain is still listed on a blocklist and has multiple vendor detections, it should remain on elevated risk watchlists until further evidence indicates the threat has been fully mitigated.