kuquoinligenus[.]webflow[.]io

PhishDestroy identifies kuquoinligenus.webflow.io as an active credential harvesting domain posing a significant threat through generic phishing tactics. This domain leverages the legitimate Webflow.io hosting platform to impersonate a financial or service-related portal, tricking users into entering credentials that are immediately exfiltrated to attacker-controlled systems. This domain was flagged by 12 of 95 VirusTotal security vendors, indicating a high detection rate among industry tools. Hosted on IP 172.64.151.8 with a Google Trust Services SSL certificate, it presents a veneer of legitimacy to evade basic detection mechanisms. While the exact registrar and creation date remain unverified in public records, the domain’s association with Webflow.io—a platform known for legitimate web development—highlights the effectiveness of abusing trusted services in phishing campaigns. Further, the low but concerning detection rate suggests this domain may have flown under the radar for some time, increasing its potential impact. If users have interacted with kuquoinligenus.webflow.io, they should immediately reset passwords for any accounts where credentials may have been entered and enable multifactor authentication where available. Avoid visiting the domain entirely and report it to your organization’s SOC or security team for immediate takedown actions. Users should verify the legitimacy of any unexpected login prompts by directly accessing the official website through a known, trusted URL—never via links received through email, SMS, or other unsolicited communications. Additionally, monitor financial accounts and enable transaction alerts to detect any unauthorized activity resulting from credential compromise.