kukoinflgi[.]webflow[.]io

This domain, kukoinflgi.webflow.io, is identified as a brand impersonation phishing resource targeting Google’s identity and associated services. Analysis indicates the page mimics a cryptocurrency exchange login portal, specifically designed to harvest user credentials under the guise of a legitimate platform. The domain is currently offline, though prior activity suggests a focus on credential theft rather than direct financial exfiltration. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameCheap, Inc., and resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy. Detection metrics show the domain is flagged by 18 of 95 security vendors on VirusTotal and appears on one blocklist. The page title, 'Ku𝐂oin^* Login | Crypto Exchange | Bitcoin Exchange,' employs Unicode obfuscation to evade basic detection mechanisms while impersonating a well-known exchange brand. Current status confirms the domain has been taken offline, though residual risk remains due to the infrastructure’s persistence. Organizations and users are advised to block the domain and associated IP at perimeter security controls. Monitoring for similar Unicode-based obfuscation in domain registrations and page titles is recommended, particularly those impersonating cryptocurrency platforms or major technology brands. Security teams should review logs for prior connections to 104.18.36.248 and assess potential credential exposure.