kukoen-login[.]webflow[.]io

PhishDestroy identifies kukoen-login.webflow.io as an active credential theft domain deployed via Webflow, targeting unsuspecting users with a fake login portal designed to harvest credentials. This domain impersonates a legitimate service to trick victims into entering their login details, potentially exposing sensitive accounts to unauthorized access. No known crypto drainer kit or specific brand impersonation was detected in this campaign, but the infrastructure suggests opportunistic credential harvesting against a variety of targets.

Technical indicators confirm elevated risk: VirusTotal flags the domain with 15/95 detections from security vendors, indicating partial but not universal recognition of the threat. The domain resolves to IP 172.64.151.8, hosted on Cloudflare infrastructure, and uses a Google Trust Services SSL certificate for credibility. The domain is registered under Webflow (via Cloudflare Registrar), and while creation date is not publicly available, the active status and recent detection indicate ongoing abuse. Google Safe Browsing has not yet flagged this domain, and blocklist monitoring shows limited coverage, increasing the risk of exposure to users.

The domain remains active with no public takedown or blocklist intervention to date, representing an elevated ongoing threat. Immediate response actions include blocking the domain at the network and endpoint levels, revoking any exposed credentials, and increasing user awareness to prevent further compromise. Remaining risk is moderate due to partial detection coverage and active hosting, requiring continuous monitoring and proactive mitigation to prevent credential-based attacks.