kikinlogix[.]webflow[.]io

Analysis of the domain kikinlogix.webflow.io shows that it was registered on 21 February 2026 through NameCheap, Inc. The domain resolves to 104.18.36.248, an address owned by AS13335 Cloudflare, Inc., located in the United States. DNS records list the authoritative nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, confirming that the site was fronted by Cloudflare’s edge network and served over HTTP/3. The TLS certificate presented is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS handshake despite the malicious content. The only publicly visible artifact is the page title “ꝄuCoin® ℓoℊin@% A Step‑te‑p Guide to Access Your Account,” which references a cryptocurrency‑related login lure.

VirusTotal scans have flagged the domain in 16 of 93 security vendors, and the site appears on a single external blocklist. PhishDestroy has actively blocked the domain, and a request for the page now returns HTTP 404, suggesting the host has taken the site offline. The risk rating assigned by the reporting system is elevated, reflecting the combination of vendor detections, the targeted brand language, and the use of reputable hosting services to obscure the attacker’s origin. Uncertainty remains regarding the exact phishing kit or payload delivered, as no further payload samples or network traffic have been released.

The short lifespan—creation in February 2026 and takedown by July 2026—limits the available forensic artifacts. Defenders should continue to monitor the associated IP address 104.18.36.248 for any resurgence of malicious pages, enforce blocklists that include kikinlogix.webflow.io, and consider adding the domain to internal blacklists. Because the domain leveraged Cloudflare’s CDN, blocking at the network layer may be insufficient; endpoint protection that inspects URL strings and correlates with threat‑intelligence feeds will provide additional coverage.